Recon learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Recon for Bug Bounty: 8 Essential Tools
   7 min readintigriti.com2026
   Library of eight essential bug bounty reconnaissance tools, including Amass for asset enumeration, Google/Bing/GitHub dorking, Eyewitness for live host screenshotting and fingerprinting, Wappalyzer for technology identification, GAU (GetAllUrls) for fetching URLs from archives, ffuf for content discovery and bruteforcing, Arjun for parameter discovery, and LinkFinder for extracting links from JavaScript files.
2. GhostTrack Explained: Track IPs Phones and Usernames Easily
   6 min readtechshali.com2026
   Tool for gathering publicly available data on phone numbers, IP addresses, and usernames. GhostTrack, a Python OSINT script currently at Version 2.2, consolidates IP tracking, phone lookup, and username search into a single menu-driven interface. While a useful learning aid and convenient for Termux users, it falls short compared to professional tools like PhoneInfoga and Sherlock, offering broader but shallower reconnaissance capabilities. The script primarily targets Debian-based Linux and Termux, and users should be aware that its phone tracking module identifies registration country and carrier, not live location.
3. Recon series #4: Port scanning methods (YesWeHack)
   8 min readyeswehack.com2026
   Library for reconnaissance techniques, detailing passive and active port scanning methods to uncover open ports and hidden services. It explores tools like Nmap, Masscan, and Naabu, and techniques such as TCP SYN, CONNECT, and UDP scanning, alongside banner grabbing for service identification. The resource also covers evasion strategies for firewalls and IDS, referencing methods like decoys and scan delays to improve stealth.
4. Bug Bounty 101: Top 10 Reconnaissance Tools
   18 min readnetlas.io2026
   Library for passive reconnaissance that aids bug bounty hunters in mapping a target's digital footprint by uncovering domains, subdomains, IP ranges, open ports, services, and historical URLs. It integrates with other tools like Maltego, Subfinder, and theHarvester, offering API and CLI access for automation.
5. A @TomNomNom Recon Tools Primer
   5 min readdanielmiessler.com2022
   Library of reconnaissance tools by @tomnomnom, including `gf` for security-pattern matching, `httprobe` for webserver detection, `unfurl` for URL parsing, `meg` for parallel requests, `anew` for de-duplicating lists, and `waybackurls` for archived URLs, all designed with the Unix philosophy for granular, composable workflows.

Real testing methodology, tooling, and writeups that show the work.

1. Uncover Hidden Assets with Bug Bounty Recon: Fuzzing and JS Analysis
   10 min readyeswehack.com2026
   Library for bug bounty reconnaissance that teaches parameter fuzzing, forced browsing, and JS analysis. It covers using tools like LinkFinder and bookmarklets for endpoint discovery, integrating Burp Suite extensions such as JSLinkFinder, GAP, and JSpector for automated JS analysis, and employing techniques like path and parameter fuzzing to uncover hidden assets and potential vulnerabilities.
2. xpfarm: Automated bug bounty & recon framework (GitHub)
   8 min readgithub.com2026
   Library wrapping offensive security tools like Subfinder, Naabu, Httpx, Nuclei, Nmap, and Gowitness into a unified web UI. It offers distributed scanning, AI-generated reports via Overlord, a smart scan planner, and an interactive attack graph, supporting multiple AI providers and specialized agents for analysis.
3. Subdomain enumeration: expand attack surface with active, passive methods
   9 min readyeswehack.com2026
   Library for advanced subdomain enumeration, this resource details passive techniques using tools like Censys, Shodan, Subfinder, and Amass, alongside active methods such as DNS brute-forcing with Gobuster. It emphasizes expanding the attack surface by discovering hidden subdomains through analyzing public databases, SSL logs, and web archives, and through direct interaction with the target, offering practical examples for bug bounty hunting and penetration testing.
4. On Favicons: From Browser Icons to Attack Surface Intelligence
   17 min readbishopfox.com2026
   Library that hashes, correlates, and enriches favicon signatures to identify software and infrastructure. It leverages MurmurHash3 (MMH3) for favicon fingerprinting, explaining how static assets like favicons can bypass security controls, leak version information, and facilitate passive pivots for reconnaissance. Practical use cases include honeypot detection through mismatches and trend tracking following CVE disclosures, such as for CVE-2026-41940 (cPanel & WHM).
5. Subdomain Takeover: Proof Creation for Bug Bounties
   6 min read0xpatrik.com2026
   Writeup detailing manual subdomain takeover proof creation for bug bounty hunters, focusing on cloud providers like Amazon S3, GitHub Pages, Heroku, and Readme.io. It outlines specific verification steps using regex patterns and HTTP requests, along with actionable takeover procedures for each service, referencing can-i-takeover-xyz.

Novel research, edge cases, and the techniques that push the class forward.

1. samugit83/redamon: An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention.
   19 min readgithub.com2026
   Framework that automates offensive security operations through AI agents, chaining reconnaissance, exploitation, and post-exploitation. It features agents for credential policy validation using Hydra, CVE exploit path verification, and XSS vulnerability mapping. RedAmon utilizes a Neo4j knowledge graph to store findings, employs an AI triage agent for deduplication and ranking, and a CodeFix agent to implement fixes and create GitHub pull requests. It supports various LLM providers like OpenAI and Anthropic, integrates with OSINT tools such as Shodan and SerpAPI, and offers tunneling via ngrok or chisel.
2. The Hidden CCS2 Attack Surface on EV Chargers
   6 min readsaiflow.com2026
   Library for identifying exposed SSH and Telnet services on XCharge C6 EV chargers via the CCS2 charging port. This vulnerability, tracked as CVE-2026-9039, leverages default root:root credentials, allowing attackers with a malicious EV to gain full control, enabling energy theft or physical damage. The CCS2 interface acts as a network port, exposing services bound to all interfaces, including those accessible from connected vehicles, highlighting a broader industry risk of misconfigured administrative services.
3. Mastering Recon in Bug Bounty: Advanced Techniques 2025
   medium.com2026
   Mastering Recon in Bug Bounty: Advanced Techniques 2025
4. vxcontrol/pentagi: ✨ Fully autonomous AI Agents system capable of performing complex penetration testing tasks
   57 min readgithub.com2026
   Library for fully autonomous AI agents designed to perform complex penetration testing tasks. PentAGI integrates over 20 professional security tools, including nmap, metasploit, and sqlmap, within a sandboxed Docker environment. It features a smart memory system, knowledge graph integration with Neo4j, and web intelligence capabilities. The system supports external search systems like Tavily and Perplexity, delegating tasks to specialized AI agents. It offers comprehensive monitoring via Grafana/Prometheus, detailed reporting, and scalable microservices architecture with support for numerous LLM providers and REST/GraphQL APIs.
5. Scanning malicious websites with 'infinite' number of VPN tunnels (Part 1)
   9 min readdiscounttimu.substack.com2026
   Library for creating a large number of VPN tunnels to scan malicious websites, leveraging Policy Based Routing and network namespaces. This approach aims to circumvent IP blocking by residential IP filters and other threat actor countermeasures, inspired by a previous system that utilized over 80 concurrent exit nodes. The method is adaptable for modern VPN protocols like Wireguard and addresses challenges in maintaining diverse geographical IP exit points.
6. Scanning malicious websites with arbitrary number of VPN tunnels (Part 2)
   4 min readdiscounttimu.substack.com2026
   Tool for scanning malicious websites using multiple VPN tunnels. The application leverages WireGuard and network namespaces for distinct exit points in different countries, utilizing headless Playwright/Chromium browsers within each namespace. It fetches URLs from phishstats.info and phishunt.io, then compares website content across tunnels using ssdeep fuzzy hashing to detect geo-specific variations or blocking.
7. Advanced DNS Attacks: Poisoning and Exploitation
   infosecwriteups.com2025
   Understanding DNS Vulnerabilities and Practical Techniques for Exploitation and Defense