Recon Resources

Recon

Reconnaissance is the first and arguably most important phase of any security assessment. It involves systematically discovering and mapping a target's attack surface — subdomains, IP ranges, open ports, running services, technology stacks, and exposed endpoints — before any active testing begins.

Effective recon separates productive security testing from wasted effort. A thorough recon phase reveals forgotten assets, shadow IT, staging environments, and legacy systems that are often less hardened than primary applications. Many of the highest-impact bug bounty findings come from assets discovered during recon that other hunters overlook.

Modern recon combines passive and active techniques. Passive recon leverages certificate transparency logs, DNS records, web archives, search engine indexes, and public datasets to map infrastructure without touching the target. Active recon involves subdomain brute-forcing, port scanning, directory fuzzing, and technology fingerprinting. Tools like subfinder, httpx, nuclei, katana, and ffuf form the backbone of most researchers' recon pipelines.

Automation is essential at scale. Many hunters build continuous recon pipelines that monitor targets for new subdomains, changed DNS records, and newly exposed services — enabling them to test fresh attack surface before anyone else.

This page collects recon methodologies, tool guides, automation workflows, and techniques for comprehensive attack surface discovery.