The newest Recon resources are on the Recon page. For a reading order instead of a date order, see the Recon learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-06 2026 | How I Built an Automated Recon Pipeline for Bug Bounty Hunting intermediate | How I Built an Automated Recon Pipeline for Bug Bounty Hunting |
| 2026-04-03 2026 | A Step-by-Step Android Penetration Testing Guide | Hack The Box intermediate 26 min read | Guide on Android penetration testing fundamentals, offering step-by-step instructions and detailing techniques like local data storage enumeration, APK extraction, reverse engineering with JADX, decompiling/recompiling APKs, and intercepting network traffic. It emphasizes utilizing the OWASP Mobile Top Ten vulnerabilities, including improper platform usage, insecure data storage, insecure communication, and insecure authentication, while referencing real-world incidents like the Klarna and ParkMobile breaches. |
| 2026-04-03 2026 | Mobile App Pentest Cheatsheet intermediate 15 min read | Cheatsheet compiling high-value information for mobile application penetration testing, mapped to OWASP Mobile Top 10 risks. It covers distributions, frameworks like MobSF and Needle, Android and iOS testing techniques, and numerous tools including Appie, Android Tamer, Vezir Project, Mobexler, APKTool, Jadx, Qark, SUPER, AndroBugs, Simplify, GDA, Cydia Substrate, Xposed, PID Cat, Inspeckage, Frida, Fridump, House, AndBug, and Drozer. Essential commands for disassembly, rebuilding, deoptimization, and debugging are also included. |
| 2026-04-03 2026 | GarudRecon - Automated Domain Recon with XSS, SQLi, LFI, RCE Detection intermediate 13 min read | Tool automating asset discovery and vulnerability assessment, GarudRecon integrates over 80 open-source tools. It supports subdomain enumeration with tools like subfinder and amass, port scanning via naabu and nmap, and vulnerability detection for XSS, SQLi, LFI, and RCE. GarudRecon offers flexible modes for small, medium, and large scope engagements, along with workflow and fleet capabilities for complex or distributed tasks, and scheduled monitoring through cronjobs. |
| 2026-04-03 2026 | Automating Subdomain Enumeration to Discover Critical Vulnerabilities intermediate | Automating Subdomain Enumeration to Discover Critical Vulnerabilities |
| 2026-04-03 2026 | SubdomainX: All-in-One Subdomain Enumeration and Reconnaissance Tool intermediate 3 min read | Tool for comprehensive subdomain enumeration and reconnaissance, SubdomainX integrates over 12 popular enumeration tools and 7 API services including SecurityTrails, VirusTotal, and Censys. It features a multi-threaded architecture for high performance, intelligent checkpointing for resuming scans, and advanced reporting capabilities with HTML, JSON, and CSV exports compatible with security tools like OWASP ZAP, Burp Suite, and Nessus. SubdomainX supports custom wordlists, smart filtering, and detailed HTTP probing with httpx, alongside fast port scanning via smap. |
| 2026-04-03 2026 | How to Use Amass for Subdomain Enumeration and Recon Like a Pro intermediate 8 min read | Library for comprehensive subdomain enumeration and attack surface discovery. Amass employs passive OSINT techniques, leveraging Certificate Transparency logs, Shodan, Censys, and public datasets, alongside active methods like DNS brute-forcing, permutations, and scraping. It supports DNS resolution and validation, brute-forcing with custom wordlists, reverse WHOIS and ASN lookups, and infrastructure mapping via graph databases, enabling visualization with `amass viz` and change detection with `amass track`. |
| 2026-04-03 2026 | Reconnaissance 102: Subdomain Enumeration | ProjectDiscovery beginner 4 min read | Tool series exploring subdomain enumeration for penetration testing and bug bounty hunting, detailing passive techniques with `subfinder` and active methods including brute-forcing with `amass` and `puredns`. This resource emphasizes the importance of efficient information gathering through both active and passive reconnaissance to identify potential attack vectors. → projectdiscovery.io |
| 2026-04-03 2026 | GitHub - backendsystems/nibble: easy to use command line network scanner, with a clickable tui interface intermediate 2 min read | Tool for local network scanning, featuring a clickable TUI and headless JSON output. It rapidly discovers hosts, hardware manufacturers (including Raspberry Pi, Ubiquiti, Apple), and open ports with service banners for SSH, HTTP, SMB, and more. Nibble supports custom port lists, targeted scans, and remembers past scan history, offering flexibility for both interactive and scripted network analysis. |
| 2026-03-19 2026 | RECOX — Recon & Bug Bounty Toolkit intermediate Bug Bounty | Library for bug bounty hunters that automates subdomain and endpoint discovery from passive sources, guiding users through a post-recon workflow. It leverages historical web archives to find known endpoints, paths, and URLs for a given domain without active scanning, offering a structured approach to mapping attack surfaces and identifying further avenues for vulnerability research. |
| 2026-03-05 2026 | Tips to automate your hacking using N8N | @Bugcrowd beginner Bug Bounty | Implementing automation for the first time can feel overwhelming, as there is so much to learn. Get tips to use N8N to automate hacking. → bugcrowd.com |
| 2026-02-25 2026 | DotNetRussell/hackmap: HackMap — a local pentest mapping tool with real-time command execution, persistent history per target, visual attack paths, and one-click PDF reporting. Run on localhost only. No auth. Pure power. intermediate 1 min read | Tool for local penetration testing that visually maps attack paths with real-time command execution. HackMap allows users to create workspaces, add nodes with custom icons, connect them with editable edges, and execute shell commands like `whoami` or `netstat` with streaming output. It features persistent command history per node, subgraphs for hierarchical organization, ownership tracking with a skull icon, and generates detailed, hierarchical PDF reports with statistics and node connections. The application runs locally with Python 3 and Flask, requiring no authentication. |
| 2026-02-21 2026 | samugit83/redamon: An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention. advanced 19 min read AI | Framework that automates offensive security operations through AI agents, chaining reconnaissance, exploitation, and post-exploitation. It features agents for credential policy validation using Hydra, CVE exploit path verification, and XSS vulnerability mapping. RedAmon utilizes a Neo4j knowledge graph to store findings, employs an AI triage agent for deduplication and ranking, and a CodeFix agent to implement fixes and create GitHub pull requests. It supports various LLM providers like OpenAI and Anthropic, integrates with OSINT tools such as Shodan and SerpAPI, and offers tunneling via ngrok or chisel. |
| 2026-02-18 2026 | Maniesh-Neupane/BugBounty-Recon-Methodology beginner 3 min read Bug Bounty | Methodology detailing bug bounty reconnaissance, covering global footprint identification using `asnmap`, `dnsx`, `whois`, and various third-party API scraping for IP ranges. It outlines subdomain enumeration techniques with tools like `subfinder`, `findomain`, `amass`, and `Chaos`, followed by data validation and permutation scanning via `puredns` and `alterx`. The process includes service mapping with `naabu` and `nmap`, virtual host discovery using `ffuf`, and web application analysis with `httpx` and `nuclei` for CVEs and misconfigurations. Finally, it details JavaScript mining with `waymore` and `katana`, sensitive file extraction, and automated vulnerability testing for injection and XSS using `arjun`, `gf`, and `ffuf`. |
| 2026-02-17 2026 | vxcontrol/pentagi: ✨ Fully autonomous AI Agents system capable of performing complex penetration testing tasks advanced 57 min read AI | Library for fully autonomous AI agents designed to perform complex penetration testing tasks. PentAGI integrates over 20 professional security tools, including nmap, metasploit, and sqlmap, within a sandboxed Docker environment. It features a smart memory system, knowledge graph integration with Neo4j, and web intelligence capabilities. The system supports external search systems like Tavily and Perplexity, delegating tasks to specialized AI agents. It offers comprehensive monitoring via Grafana/Prometheus, detailed reporting, and scalable microservices architecture with support for numerous LLM providers and REST/GraphQL APIs. |
| 2026-02-16 2026 | How I Built a 5-Path AI “Recon Beast” with n8n and Gemini (2026 Guide) intermediate AI Bug Bounty | In 2026, the bug bounty landscape requires more than just speed, with AI enhancing attacker capabilities. The article discusses building a 5-Path AI "Recon Beast" using n8n and Gemini. This innovative approach leverages automation and AI to enhance reconnaissance processes for bug bounty hunting. The focus is on utilizing technology to improve efficiency and effectiveness in identifying vulnerabilities. |
| 2026-01-22 2026 | Recon to Master: The Complete Bug Bounty Checklist beginner Bug Bounty | “” is published by 𝙇𝙤𝙨𝙩𝙨𝙚𝙘 in InfoSec Write-ups. → infosecwriteups.com |
| 2026-01-22 2026 | My 5-Minute Workflow to Find Bugs on Any Website beginner Bug Bounty | My 5-Minute Workflow to Find Bugs on Any Website A step-by-step guide to my most effective, shortcut methods for bug bounty hunting. Introduction Hi everyone, welcome back! Today, I’m going to show … → infosecwriteups.com |
| 2026-01-20 2026 | MantisSTS/JSReconduit: Passive JavaScript reconnaissance for penetration testers — bridging Burp Suite traffic into structured, AST-based analysis in VSCode. intermediate 5 min read Burp | Library for passive JavaScript reconnaissance, JSReconduit bridges Burp Suite traffic into VSCode for AST-based analysis. It captures JavaScript assets via a Burp extension, then the VSCode extension analyzes them, rendering findings like HTTP/WebSocket endpoints, drift detection, cluster analysis, dataflow traces, secrets, and signature matches in a sidebar. This tool supports deobfuscation, sourcemap resolution, and generates various reports, including endpoint lists, sink analysis, and risk-ranked asset triage. |
| 2026-01-18 2026 | 0x0FB0/pulsar: Network footprint scanner platform. Discover domains and run your custom checks periodically. intermediate 3 min read | Platform for automated network footprint scanning, Pulsar discovers organization public-facing assets like subdomains, TLDs, and cloud resources. It provides network data visualization, assigns basic vulnerability scores, and functions as a custom scanner for broad scopes, free of API key requirements. Installation involves Git and Docker, with separate scripts for Windows and Linux. |
| 2025-12-03 2025 | ✨ How to get private invitations on #BugBounty platforms ✨ beginner Bug Bounty | 🗨️ Answer: You don’t have to! I noticed that around 70% of my HackerOne private invitations also have public self-hosted bug bounty programs 🙂 Here’s the dorks list I use to find these platforms 🫡 |
| 2025-11-24 2025 | GitHub - tg12/dns-honeypot: dns-honeypot intermediate 5 min read | Tool for deploying a DNS honeypot using Docker Compose, integrating Unbound, Loki, Prometheus, Grafana, and Traefik. This setup passively logs and visualizes DNS queries from the internet, capturing traffic patterns, top queried domains like `scb.se` and `atlassian.com`, and busy client IPs. It facilitates analysis of internet noise, misconfigurations, and scanning activity through detailed dashboards and exportable CSV data. |
| 2025-11-21 2025 | WebRecon from @D4rk_Intel is another OSINT multi-tool worth knowing about. 🧠 beginner OSINT | It automates web crawling, tech stack detection, DNS & WHOIS intel, email harvesting, Wayback lookups, and exports clean JSON reports. Try it here: https://t.co/6inbXMqnsZ |
| 2025-11-08 2025 | robre/jsmon: a javascript change monitoring tool for bugbounties beginner 2 min read Bug Bounty | Tool for monitoring JavaScript file changes on websites. JSMon fetches configured files, compares them to previous versions, and sends notifications via Telegram or Slack upon detection of changes. Notifications include the affected files, size differences, and a diff file for easy inspection. The tool supports cron scheduling for regular checks and allows configuration of notification tokens and target files. |
| 2025-08-14 2025 | ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ on Twitter: "RT @SecurityTrybe: Top 25 Recon Tools and thei beginner | Daniel Miessler shared a tweet about the top 25 Recon Tools, but the content seems to be cut off. It likely refers to a list of tools used for reconnaissance in cybersecurity. Recon tools are essential for gathering information about potential targets to assess vulnerabilities and plan security measures. Daniel Miessler's tweet may have been promoting or sharing valuable resources related to cybersecurity tools and practices. |
| 2025-08-14 2025 | Ekultek/Zeus-Scanner: Advanced reconnaissance utility beginner 5 min read | Tool for advanced web application reconnaissance, Zeus automates the process of finding URLs through multiple search engines and bypassing captchas. It supports various proxy types, extracts URLs from ban and webcache results, and integrates with tools like sqlmap for SQL injection assessments and nmap for port scanning. Zeus also enumerates WAF/IPS/IDS protection and performs header analysis, offering a comprehensive approach to discovering vulnerabilities such as XSS and clickjacking. |
| 2025-08-14 2025 | m0rtem/CloudFail: Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network beginner 1 min read | Tool for tactical Cloudflare reconnaissance, CloudFail aims to discover origin server IPs. It employs Tor for masked requests and features three attack phases: misconfigured DNS scanning via DNSDumpster.com, Crimeflare.com database lookup, and a brute-force scan of over 2500 subdomains. CloudFail is a Proof of Concept for academic and controlled environment testing only. |
| 2025-08-14 2025 | leebaird/discover: Custom Bash and Python scripts used to automate various penetration testing tasks including… beginner 4 min read | Library of custom bash scripts automating penetration testing tasks, including recon with tools like theHarvester, DNSRecon, and dnstwist; scanning using Nmap and Metasploit; web security checks for IDOR and SSL issues; and malicious payload creation with Metasploit. It also supports container security analysis for Docker and Kubernetes environments using Trivy, and facilitates parsing of scan results from Burp, Nessus, and Nmap. |
| 2025-08-14 2025 | BishopFox/GitGot: Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for… beginner 2 min read | Tool for rapidly searching public GitHub data for sensitive secrets using a semi-automated, feedback-driven approach. GitGot allows users to blacklist files by filename, repository, username, or fuzzy content matches, with saved blacklists reusable across similar queries. It supports session pausing and resuming, utilizes GitHub's advanced search syntax, and requires a GitHub API token for rate limiting. Installation involves installing the `ssdeep` dependency and then Python dependencies. |
| 2025-08-14 2025 | s0md3v/Striker: Striker is an offensive information and vulnerability scanner. beginner | Library for automated web application security scanning. Striker 2.0, in prototype, finds subdomains, scans common TCP ports, and analyzes HTTP headers for misconfigurations and sensitive files. It crawls subdomains to detect outdated JavaScript libraries using data from Retire.js, identifies CMS and technologies via Wappalyzer signatures, and analyzes WAF signatures sourced from sqlmap. HTML forms are collected for later vulnerability testing. |
| 2025-08-14 2025 | s0md3v/ReconDog: Reconnaissance Swiss Army Knife beginner 2 min read | Tool that automates reconnaissance by extracting targets from STDIN and utilizing APIs to gather information without direct contact. It integrates with services like Censys, Shodan, and Wappalyzer to perform tasks such as port scanning, CMS and technology detection, subdomain enumeration, WHOIS lookups, and honeypot identification. Recon Dog supports both wizard and command-line interfaces and can parse input from other tools using regular expressions. |
| 2025-04-11 2025 | Nmap for Beginners: Easy Tips to Scan Networks Like a Pro beginner | So, Think this :::: one night when you are trying to sleep , suddenly you imagine what’s happening on your network .. what devices are connected? What services are they running? {JUST 2 AM THOUGHTS… → infosecwriteups.com |
| 2025-04-09 2025 | From Recon to Exploits: Uncovering XSS, Open Redirects, and More using this script intermediate | Step by Step guide to hunt info disclosure, xss and more → osintteam.blog |
| 2025-03-31 2025 | Javascript Recon for Bug Bounty & Pentesting intermediate Bug Bounty XSS | Hidden endpoints, secrets, and DOM XSS using Automated JS Analysis |
| 2025-03-22 2025 | A Deep Dive into Nmap Scripts for Web Application Testing | by Khaleel Khan | System Weakness intermediate | A Step-by-Step Guide to Leveraging Nmap’s Most Advanced Scripts for Comprehensive Web Application Security Analysis This scenario showcases how an experienced penetration tester could leverage Nmap’s… |
| 2025-02-22 2025 | GitHub - Arcanum-Sec/msftrecon beginner 1 min read | Tool for red teamers and security professionals to map Microsoft 365 and Azure tenant infrastructure. MSFTRecon performs comprehensive, unauthenticated enumeration, identifying potential security misconfigurations and attack vectors. It reveals identity attack vectors, application attack surfaces including OAuth abuse, infrastructure insights like Azure service mapping, and security control awareness such as conditional access configurations. The tool supports targeting government and China cloud instances. |
| 2025-02-12 2025 | GitHub - Chocapikk/wpprobe: A fast WordPress plugin enumeration tool beginner 3 min read | Tool for fast WordPress plugin and theme enumeration, detecting over 5000 plugins without brute-force and thousands more with it. It utilizes REST API enumeration and HTML parsing, mapping findings to CVEs from Wordfence and WPScan databases, including vulnerabilities like PHP Object Injection. The tool supports stealthy, brute-force, and hybrid scanning modes, with optional Wordfence and WPScan API key integration for enhanced database updates. |
| 2025-02-10 2025 | GitHub - LuffySec/Automation-JS-Recon: This tools used for Automating finding of subdomain, and checking for alive subdomain, and gathering js files from all the subdomain and then automating finding of sensitive information on all the js files intermediate | Tool for automating reconnaissance, including subdomain discovery using subfinder and login endpoint identification with dorkscaper.py. It verifies live subdomains via LUcek, fetches URLs with waybackurls, filters JavaScript files, and then uses nuclei to analyze these JS files for sensitive information. |
| 2025-02-10 2025 | GitHub - g4xyk00/JSrecon: Reconnaissance on browser using Javascript intermediate | Reconnaissance on browser using Javascript . Contribute to g4xyk00/JSrecon development by creating an account on GitHub. |
| 2025-02-01 2025 | A Burpsuite Extension For JS Reconnaissance - Jsmon intermediate 2 min read Burp | Library for enhancing JavaScript reconnaissance within Burp Suite. Jsmon automatically scans and monitors JavaScript files, providing real-time alerts for client-side exposures, secrets, and vulnerabilities. It offers seamless integration, scope filtering to conserve API calls, and manual analysis options, streamlining web security testing and improving the detection of exploitable JavaScript issues. |
| 2025-01-30 2025 | Advanced DNS Attacks: Poisoning and Exploitation advanced | Understanding DNS Vulnerabilities and Practical Techniques for Exploitation and Defense → infosecwriteups.com |
| 2025-01-29 2025 | GitHub - Chleba/netscanner: Terminal Network scanner & diagnostic tool with modern TUI beginner 1 min read | Tool for terminal-based network scanning and diagnostics featuring a modern TUI. It lists hardware interfaces, allows switching active interfaces for scanning and packet-dumping, scans WiFi networks and signal strength with charts, and performs IPv4 pinging of CIDRs with hostname, OUI, and MAC address resolution. The tool also supports IPv4 and IPv6 packet dumping (TCP, UDP, ICMP, ARP, ICMP6), pausing packet dumps, scanning open TCP ports, filtering packet logs, exporting scanned data to CSV, and traffic counting with DNS records. It relies on Ratatui and libpnet libraries. |
| 2025-01-28 2025 | GitHub - aceberg/WatchYourLAN: Lightweight network IP scanner. Can be used to notify about new hosts and monitor host online/offline history beginner 2 min read | Tool for lightweight network IP scanning, WatchYourLAN detects new hosts, monitors online/offline history, and logs all devices. It supports data export to InfluxDB2 or Prometheus for Grafana dashboards. While lacking built-in authentication, it can integrate with SSO tools like Authelia or ForAuth. Installation is available via Docker, with binary packages for various Linux distributions and architectures, and dependencies include `arp-scan` and `tzdata`. |
| 2025-01-19 2025 | GitHub - blacklanternsecurity/bbot: The recursive internet scanner for hackers. 🧡 beginner 4 min read | Library for automated reconnaissance and bug bounty hunting, BEE·bot (bbot) acts as a recursive internet scanner. It excels at subdomain enumeration, often finding 20-50% more than other tools by utilizing passive API sources and recursive DNS brute-forcing with target-specific mutations. BBOT also features a recursive web spider for crawling and extracting information, email enumeration modules, and various web scanning presets, including a "kitchen-sink" option for comprehensive scans. The tool supports multiple target types and integrates with third-party APIs via keys for services like SecurityTrails and VirusTotal. |
| 2025-01-12 2025 | GitHub - RustScan/RustScan: 🤖 The Modern Port Scanner 🤖 beginner 2 min read | Library for fast port scanning; it scans all 65k ports in as little as 3 seconds. Features include a scripting engine supporting Python, Lua, and Shell for custom analysis, automatic piping of results into Nmap, and adaptive learning that improves scan performance over time. RustScan also prioritizes accessibility and offers installation via package managers like Homebrew and Pacman. |
| 2024-12-14 2024 | 🚀 Introducing ShodanSpider v2: Your Ultimate Free Tool for CVE Searching and Shodan Data Analysis… news | In today’s fast-paced cybersecurity world, staying ahead of vulnerabilities is critical. ShodanSpider v2 takes your security research to… |
| 2024-09-24 2024 | xssorRecon/xss0rRecon.sh at main · xss0r/xssorRecon beginner 25 min read Bug Bounty XSS | Tool that automates XSS reconnaissance, featuring functions for installing prerequisites like `python3-venv`, creating virtual environments, and handling installation errors with suggested solutions. It provides a menu-driven interface for users to select options such as installing all tools, entering target domains, performing domain and URL enumeration, finding hidden parameters with HiddenParamFinder, preparing for XSS detection, and launching the xss0r tool itself. The script also includes guidance on deploying xss0r on VPS servers, recommending Contabo and providing relevant commands for tmux session management. |
| 2024-09-13 2024 | GitHub - xss0r/xssorRecon: Automate Recon XSS Bug Bounty intermediate Bug Bounty XSS | Library for automating XSS bug bounty reconnaissance, xss0rRecon requires users to download tools, wordlists, and the main application, then extract them into a single directory for execution. A free 5-day PRO plan license is available from the 10th to the 15th of each month via store.xss0r.com. |
| 2024-09-09 2024 | GitHub - mohdh34m/TraceNinja: TraceNinja is a subdomain enumeration tool . And much much more on the future ^_^ beginner | Tool for Python-based subdomain enumeration. TraceNinja efficiently gathers domain information in real-time across multiple platforms, offering a fast and user-friendly experience. Installation is available via pip or manual cloning. Users can execute scans with `TraceNinja -d example.com` and access all options using `TraceNinja -h`. The project welcomes contributions and is released under the MIT License. |
| 2024-07-28 2024 | security-study-plan/web-pentest-study-plan.md at main · jassics/security-study-plan beginner 6 min read Bug Bounty | Guide for aspiring web penetration testers, detailing a comprehensive study plan. It covers fundamental concepts like HTTP security, authentication, authorization, and various vulnerabilities including XSS, SQLi, IDOR, JWT, and SSRF. Essential tools such as Burp Suite, OWASP ZAP, Metasploit, and Nmap are introduced, alongside practical lab resources like Hack The Box, TryHackMe, and OWASP Juice Shop. Recommended reading includes "The Web Application Hacker's Handbook" and the OWASP Testing Guide, with optional courses and certifications like eJPT and OSCP also mentioned. |