The newest Recon resources are on the Recon page. For a reading order instead of a date order, see the Recon learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-17 2026 | bountyRecon: Bash automation for bug bounty recon intermediate | bountyRecon: Bash automation for bug bounty recon |
| 2026-04-17 2026 | JSFScan.sh: JavaScript recon automation (KathanP19) intermediate 2 min read | Tool for automating JavaScript reconnaissance in bug bounty programs. JSFScan.sh gathers JavaScript file links from various sources, extracts endpoints and secrets, fetches JS files for manual analysis, generates wordlists, identifies variables, scans for DOM XSS, and produces HTML reports. It can be run locally or within a Docker container, offering options for targeted scans or comprehensive analysis using tools like hakrawler. |
| 2026-04-17 2026 | Reconky: Content discovery bash script intermediate 1 min read | Library for automated reconnaissance and information gathering. This Bash script, Reconky, uses tools like assetfinder, Sublist3r, amass, knockpy, httprobe, nmap, waybackurls, and eyewitness to gather subdomains, check for duplex, perform dictionary attacks, identify alive domains, investigate subdomain takeovers, scan open ports, extract parameters, collect files, and capture screenshots. It also assists in assembling possible parameters from wayback_url data and pulling json/js/php/aspx/ files. |
| 2026-04-17 2026 | Bug-Bounty-Automation: Bash recon (Retr0-45809) intermediate | Library automating bug bounty reconnaissance using Bash scripting. It orchestrates tools like Sublister, Eyewitness, Assetfinder, Amass, Httprobe, Nmap, and Sqlmap, requiring Kali Linux, Python, and Golang. The script executes multiple recon tools sequentially, storing their outputs for a comprehensive view of web application, mobile app, and other platform vulnerabilities. |
| 2026-04-17 2026 | Recon-Script: automation with Nuclei (s1d6point7bugcrowd) intermediate 2 min read | Library for automating Nuclei vulnerability scans, integrating features like voice notifications via espeak, proxychains support, and optional cloud uploads to ProjectDiscovery Cloud Platform (PDCP). It allows for out-of-scope filtering, custom bug bounty headers, and detailed scan logging with timestamps, supporting tools such as subfinder, dnsx, and httpx. |
| 2026-04-17 2026 | Bug-Bounty-Recon-Automation shell script (Amangupta1234) intermediate 1 min read | Library for automating bug bounty reconnaissance tasks. This Bash script streamlines project documentation, subdomain enumeration using Sublist3r and assetfinder, subdomain resolution with httprobe, and directory bruteforcing/fuzzing with dirsearch. It also includes subdomain takeover detection via Subjack and JavaScript file discovery with subjs, simplifying repetitive processes for hunters. |
| 2026-04-17 2026 | The Ultimate Guide to Finding Bugs With Nuclei (ProjectDiscovery) beginner 43 min read | Library for efficient, extensible vulnerability scanning using YAML-based templates. Nuclei supports HTTP, DNS, SSL, and raw TCP protocols, allowing detection of CVEs, misconfigurations, and sensitive file exposures. It integrates into workflows with other tools and offers features like custom template creation, fuzzing, advanced DSL for matchers, and various scan modes including headless and network. Advanced options include rate limiting, template filtering by technology, severity, or name, and resuming interrupted scans. → projectdiscovery.io |
| 2026-04-17 2026 | xpfarm: Automated bug bounty & recon framework (GitHub) intermediate 8 min read | Library wrapping offensive security tools like Subfinder, Naabu, Httpx, Nuclei, Nmap, and Gowitness into a unified web UI. It offers distributed scanning, AI-generated reports via Overlord, a smart scan planner, and an interactive attack graph, supporting multiple AI providers and specialized agents for analysis. |
| 2026-04-17 2026 | Automate Your Nuclei Recon Pipeline with VPN + Discord Alerts intermediate 3 min read | Script automates bug bounty reconnaissance by enumerating subdomains with subfinder, probing live hosts via httpx, rotating NordVPN IPs, and running Nuclei scans with specific templates and filters. It sends Discord alerts for any found vulnerabilities, detailing the count, severity, template ID, matched target, and current IP. The process is designed for repeatable, single-command execution on a list of target domains. |
| 2026-04-17 2026 | Advanced Recon: Taking Your Subdomain Discovery to the Next Level intermediate | Advanced Recon: Taking Your Subdomain Discovery to the Next Level |
| 2026-04-17 2026 | GitHub dorking for beginners: find more vulnerabilities (Intigriti) beginner 7 min read | Guide detailing how to leverage GitHub's advanced search operators for bug bounty hunting. It covers essential techniques like using `org:`, `user:`, `extension:`, and boolean operators, alongside advanced filters such as `filename:`, `language:`, and `path:`. Specific examples demonstrate finding hard-coded secrets like Stripe API keys, AWS access keys, and OpenAI API keys, as well as sensitive configuration files, hard-coded URLs, database connection strings, and JWT secrets. → intigriti.com |
| 2026-04-17 2026 | google-dorks-bug-bounty (TakSec, GitHub) intermediate 2 min read | Library of Google Dorks for bug bounty hunting, web application security, and penetration testing. This collection includes dorks for discovering configuration files, error messages, API endpoints, potential vulnerabilities, sensitive documents, administrative interfaces, and various subdomain structures. It also provides example queries for identifying specific technologies like Apache and Drupal, and for searching on platforms like Pastebin, GitHub, and cloud storage services. |
| 2026-04-17 2026 | How I Found Sensitive Information using GitHub Dorks (Part 3) intermediate | How I Found Sensitive Information using GitHub Dorks (Part 3) |
| 2026-04-17 2026 | Complete Guide to Amass Tool (2025 Edition) beginner 12 min read | Library for comprehensive Amass recon and subdomain enumeration, covering installation on Kali Linux, Termux, and Windows WSL. It details Amass modules like Enum, Intel, Viz, Track, and DB, and provides basic usage examples for discovering subdomains, mapping DNS, and performing passive and active recon. The guide also includes pro tips for bug bounty hunters and installation via GitHub binary. |
| 2026-04-17 2026 | Mastering Passive Reconnaissance for Bug Bounty and Pentesting beginner | Mastering Passive Reconnaissance for Bug Bounty and Pentesting |
| 2026-04-17 2026 | Mastering OSINT for Bug Bounty: Advanced Deep Recon intermediate 4 min read | Library for performing deep reconnaissance in bug bounty hunting, this resource details advanced Open-Source Intelligence (OSINT) tools and techniques. It covers subdomain enumeration with Amass and Subfinder, exposed service discovery using Shodan and Censys, and secret finding via GitHub Dorks and Gitleaks. The guide also explores identifying technologies and employees through LinkedIn and Twitter, and extracting metadata with ExifTool and FOCA, outlining a comprehensive workflow for mapping targets and identifying vulnerabilities. |
| 2026-04-17 2026 | Mastering Passive Information Gathering: Extensive OSINT Guide beginner 30 min read | Guide detailing passive information gathering, also known as OSINT, crucial for penetration testing and threat research. It covers objectives, methodologies including domain reconnaissance, metadata analysis, SOCMINT, and public records. Core tools such as WHOIS, Dig, ExifTool, FOCA, and platforms like LinkedIn and GitHub are discussed, alongside ethical considerations, operational security (OPSEC) practices, and data analysis techniques using tools like Maltego. Real-world use cases, reporting, and future trends like AI-assisted OSINT are also explored. |
| 2026-04-17 2026 | 9 Attack Surface Monitoring Tools in 2026 (SentinelOne) news 16 min read | Library for discovering and managing attack surface exposures, including open ports, subdomains, misconfigurations, and public-facing APIs. It integrates with SIEMs and incident response teams, providing real-time risk assessment and addressing multi-cloud and hybrid complexities. SentinelOne Singularity™ Cloud Security, a CNAPP solution, offers features like CSPM, CIEM, EASM, AI-SPM, CWPP, and CDR, with autonomous AI-based protection and secret detection. → sentinelone.com |
| 2026-04-17 2026 | Recon Methodology: Subdomain Enumeration beginner | Recon Methodology: Subdomain Enumeration |
| 2026-04-17 2026 | Recon Guide: Subdomain Enumeration beginner | Recon Guide: Subdomain Enumeration |
| 2026-04-17 2026 | Bug-Bounty-recon: Automated recon framework (GitHub) intermediate 2 min read | Library for automated reconnaissance in authorized security testing and bug bounty programs. It chains tools like subfinder, assetfinder, httpx, and nuclei to discover subdomains, identify login pages, admin panels, APIs, and perform Nmap scans. The framework detects changes between runs, reporting only new subdomains, open ports, and findings, ideal for scheduled or continuous monitoring on VPS. |
| 2026-04-17 2026 | Subdomain enumeration: expand attack surface with active, passive methods intermediate 9 min read | Library for advanced subdomain enumeration, this resource details passive techniques using tools like Censys, Shodan, Subfinder, and Amass, alongside active methods such as DNS brute-forcing with Gobuster. It emphasizes expanding the attack surface by discovering hidden subdomains through analyzing public databases, SSL logs, and web archives, and through direct interaction with the target, offering practical examples for bug bounty hunting and penetration testing. → yeswehack.com |
| 2026-04-16 2026 | Passive Reconnaissance Using OSINT beginner 6 min read | Library for performing passive reconnaissance using OSINT, detailing methodologies for mapping public-facing infrastructure without direct interaction. It emphasizes techniques like Google Advanced Search, analyzing client-side scripts with tools like LinkFinder, and leveraging external services such as crt.sh, Findsubdomains.com, and Censys.io to discover subdomains, exposed services, and potential vulnerabilities like token leaks or privilege escalation. The library highlights real-world examples, including bounties from Snapchat and Shopify, and the discovery of misconfigured Jenkins instances. |
| 2026-04-16 2026 | From Recon to Sensitive Key Exposure Using Nuclei intermediate | From Recon to Sensitive Key Exposure Using Nuclei |
| 2026-04-16 2026 | reconFTW: Automated Recon Tool intermediate 25 min read | Library for automated reconnaissance, reconFTW automates subdomain enumeration, vulnerability scanning for XSS, SSRF, SQLi, and more, and OSINT gathering. It supports distributed scanning via AX Framework, integrates with Faraday for reporting, and leverages tools like subfinder, nuclei, ffuf, and SQLMap for comprehensive intelligence. |
| 2026-04-16 2026 | A Deep Dive on Katana Field Extraction intermediate 4 min read | Tool for headless web crawling and field extraction. Katana, a Golang-based CLI tool from ProjectDiscovery, efficiently spiders web applications and supports customizable field extraction using regex. It reduces unstructured data by allowing users to filter and utilize output for reconnaissance pipelines or to identify specific data like unique parameters for fuzzing XSS vulnerabilities. Katana supports predefined fields and custom regex-based extraction for enhanced data processing. → projectdiscovery.io |
| 2026-04-16 2026 | Subdomain Takeover in 2025: New Methods and Tools intermediate 3 min read | Library detailing subdomain takeover techniques, focusing on their continued effectiveness in 2025 due to widespread cloud adoption. It covers the fundamental mechanism of takeovers, their inherent dangers such as brand reputation damage and facilitating phishing, and outlines a step-by-step workflow involving subdomain enumeration with tools like `subfinder` and `dnsx`, followed by exploitation checks. The resource also highlights essential tools such as `httpx` and `subzy`, and demonstrates an automated exploitation example on Heroku. |
| 2026-04-16 2026 | My Complete Recon Workflow for Bug Bounty Hunting (2025) intermediate 4 min read | Library of tools and techniques for bug bounty hunting reconnaissance, detailing subdomain enumeration with Subfinder, Amass, Sublist3r, and Aquatone; DNS discovery using DNSrecon and DNSEnum; host discovery with httpx; automation via ReconFTW; and port scanning and fingerprinting with Nmap, Rustscan, and Masscan. |
| 2026-04-16 2026 | Internet-Wide Recon: Moving Past IP-Centric Approaches intermediate 20 min read | Reference on internet-wide reconnaissance challenges, this resource discusses the limitations of IP-centric scanning approaches due to modern cloud architectures, complex routing, WAFs, CDNs, and TLS-SNI. It highlights how relying solely on IP addresses can miss significant attack surface by failing to identify numerous subdomains pointing to the same IP, leading to incorrect host header values and application routing. The discussion emphasizes the need for more robust discovery methods that consider subdomain data and associated metadata for comprehensive attack surface mapping. → assetnote.io |
| 2026-04-16 2026 | The Art of Recon: Strategies for Modern Asset Discovery beginner 36 min read | Technique outlining modern asset discovery and reconnaissance strategies, moving beyond purely tool-centric approaches. This method emphasizes a conceptual framework comprising breadth, depth, context, amplification, and focus to achieve outcome-driven reconnaissance, enabling the discovery of critical vulnerabilities and unique insights into an organization's attack surface. The approach acknowledges the evolution of IT infrastructure, from traditional data centers to cloud-native environments, and adapts reconnaissance techniques accordingly. → assetnote.io |
| 2026-04-14 2026 | GitHub - retlehs/quien: A better WHOIS lookup tool beginner 3 min read | Tool for domain and IP intelligence, offering an interactive TUI with tabbed views for WHOIS, DNS, mail configuration (SPF, DMARC, DKIM, BIMI), SEO analysis, and tech stack detection. It supports RDAP and WHOIS lookups, IP analysis with ASN discovery, and optional Core Web Vitals field data from the CrUX API. Features include JSON output for scripting, automatic retries, and customizable resolvers. |
| 2026-04-10 2026 | Recon Roundup: Ultimate Reconnaissance Guide beginner 3 min read | Guide summarizing Bug Bounty reconnaissance techniques, including subdomain enumeration, port scanning, HTTP fingerprinting, hidden-parameter mapping, Google dorking, and archive-based recon. It details how to use tools like Nmap, Shodan, and the Wayback Machine, and covers manual methods such as force browsing and fuzzing for hidden directories, aiming to uncover high-impact vulnerabilities overlooked by automated scanners. → yeswehack.com |
| 2026-04-10 2026 | From Recon to Report: Complete Workflow 2025 intermediate 4 min read Bug Bounty | Library for bug bounty hunters detailing a complete workflow from reconnaissance to reporting, including tools like Subfinder, Amass, Nuclei, Burp Suite, and Dalfox. It covers passive and active reconnaissance, enumeration techniques, vulnerability scanning for XSS and SQLi, manual testing, and effective report writing with examples for IDOR and SSRF. The resource also lists bug bounty platforms such as HackerOne and Bugcrowd, and emphasizes strategy, patience, and continuous learning. |
| 2026-04-10 2026 | Mastering Recon in Bug Bounty: Advanced Techniques 2025 advanced | Mastering Recon in Bug Bounty: Advanced Techniques 2025 |
| 2026-04-10 2026 | Recon to Master: Complete Bug Bounty Checklist beginner Bug Bounty | Recon to Master: Complete Bug Bounty Checklist |
| 2026-04-10 2026 | Awesome Bug Bounty Tools - GitHub beginner 27 min read Bug Bounty XXE | Library is a curated list of bug bounty tools categorized by vulnerability types such as SQL Injection, XSS, and Server-Side Request Forgery, along with specialized tools for subdomain enumeration (e.g., Subfinder, Findomain), port scanning (e.g., masscan, nmap), web technology identification (e.g., Wappalyzer, whatweb), and content discovery (e.g., gobuster, feroxbuster). |
| 2026-04-10 2026 | Automating Subdomain Enumeration: Tools and Techniques at Scale intermediate | Automating Subdomain Enumeration: Tools and Techniques at Scale → osintteam.blog |
| 2026-04-10 2026 | Ultimate Guide to Subdomain Enumeration for Bug Bounty beginner | Ultimate Guide to Subdomain Enumeration for Bug Bounty |
| 2026-04-10 2026 | Amass Cheat Sheet: 70+ Commands for Recon & Bug Bounty beginner 3 min read | Cheatsheet of 70+ Amass commands for reconnaissance and bug bounty hunting, detailing installation on Kali Linux, beginner and advanced techniques, and real penetration testing scenarios. This resource helps cybersecurity professionals discover subdomains, exposed infrastructure, and attack surfaces by leveraging open-source intelligence, DNS queries, and brute force methods. It also covers Amass's legal usage, its inclusion in Kali Linux, and alternatives like Subfinder and Sublist3r for comprehensive domain enumeration. |
| 2026-04-10 2026 | The Complete Bug Bounty Recon Playbook: 2025 Edition beginner | The Complete Bug Bounty Recon Playbook: 2025 Edition |
| 2026-04-10 2026 | Master Bug Bounty Hunting with Top Recon Tools beginner 3 min read | Library for automating bug bounty reconnaissance, ReconFTW gathers extensive target information using OSINT, subdomain enumeration (passive and active), port scanning, service enumeration, and web application scanning for common vulnerabilities like SQL injection, XSS, and OWASP Top Ten issues. It also performs content discovery, takes screenshots, and generates comprehensive reports with remediation recommendations, aiding bug bounty hunters, penetration testers, and security researchers. |
| 2026-04-10 2026 | Recon for Bug Bounty: 8 Essential Tools beginner 7 min read Bug Bounty | Library of eight essential bug bounty reconnaissance tools, including Amass for asset enumeration, Google/Bing/GitHub dorking, Eyewitness for live host screenshotting and fingerprinting, Wappalyzer for technology identification, GAU (GetAllUrls) for fetching URLs from archives, ffuf for content discovery and bruteforcing, Arjun for parameter discovery, and LinkFinder for extracting links from JavaScript files. → intigriti.com |
| 2026-04-10 2026 | Bug Bounty 101: Top 10 Reconnaissance Tools beginner 18 min read OSINT | Library for passive reconnaissance that aids bug bounty hunters in mapping a target's digital footprint by uncovering domains, subdomains, IP ranges, open ports, services, and historical URLs. It integrates with other tools like Maltego, Subfinder, and theHarvester, offering API and CLI access for automation. |
| 2026-04-10 2026 | 2025 Bug Bounty Methodology and Persistent Recon intermediate Bug Bounty | 2025 Bug Bounty Methodology and Persistent Recon |
| 2026-04-10 2026 | Bug Bounty Recon Methodology 2025 - GitHub intermediate 4 min read Bug Bounty | Library enumerating subdomains, APIs, and cloud assets for bug bounty hunting. This resource details techniques and tools like Subfinder, Amass, CRTSH, Github-Search, MassDNS, GAU, Waybackurls, CloudEnum, AWSBucketDump, S3Scanner, LinkFinder, GitDorker, Feroxbuster, FFuF, and Kiterunner. It also covers testing for vulnerabilities such as CSRF, LFI, RCE, and SQLi, along with reporting methodologies and evidence gathering. |
| 2026-04-08 2026 | AI Foundations and Reconnaissance (Hacking with AI) beginner 4 min read | Workshop slides from DEF CON 32 covering hardware fault injection on embedded systems, focusing on side-channel analysis and voltage glitching techniques. The material includes practical demonstrations and theoretical explanations of how to extract sensitive information from microcontrollers and IoT devices, detailing common vulnerabilities and mitigation strategies. It highlights the use of tools like ChipWhisperer for advanced penetration testing in hardware security. |
| 2026-04-06 2026 | Masriyan/Aegis: Windows Attack Surface Discovery Tool intermediate 3 min read | Tool for automated attack surface discovery, Aegis consolidates OSINT, active reconnaissance, and threat intelligence into a single interface. It features 30+ modules for tasks like subdomain enumeration, technology stack identification, SSL/TLS analysis, and mapping findings to MITRE ATT&CK techniques, with risk scoring and export capabilities to PDF, JSON, CSV, and STIX formats. Aegis operates locally without requiring API keys for core functionality. |
| 2026-04-06 2026 | External Attack Surface Management (EASM) beginner 16 min read | Library that identifies, monitors, and analyzes an organization’s public-facing digital assets, such as websites, APIs, and cloud services, to detect vulnerabilities, misconfigurations, and potential entry points. It provides an attacker's-eye view of the digital perimeter, focusing on risks from exposed services, web application flaws, cloud misconfigurations, subdomain takeovers, credential-based attacks, shadow IT exploitation, and legacy assets. |
| 2026-04-06 2026 | Using OWASP Amass with Netlas Module intermediate 3 min read | Library for reconnaissance and attack surface mapping, OWASP Amass integrates with the Netlas module. This guide details Amass installation via pre-built packages, source compilation, or Homebrew, and its configuration to leverage Netlas API keys within `datasources.yaml` for enhanced subdomain enumeration. Users can then execute `amass enum -d <domain> -include Netlas` to specifically query Netlas data or `amass enum -d <domain> -o <output_file>` to combine Netlas with other configured sources. |
| 2026-04-06 2026 | The Complete Beginner's Guide to Bug Bounty Reconnaissance beginner | The Complete Beginner's Guide to Bug Bounty Reconnaissance → infosecwriteups.com |