Recon & Attack-Surface Mapping

> Recon is not a phase you finish; it is a map you keep redrawing. The best reports in this corpus > almost always start with a target the reporter reached because they enumerated harder than anyone > else — a forgotten subdomain, a staging host, an internal API path leaked in JS, a deprecated > mobile endpoint. This page is the reusable recon methodology distilled from those reports, in the > HackTricks operational style. General background is marked as such; concrete tells are cited to the > case studies where they show up (see the class pages).

§Mental model

Attack surface = every place your input reaches their code. You expand it along four axes:

Horizontal — more hosts/apps owned by the same org (root domains, acquisitions, ASNs).
Vertical — more of one app (subdomains, vhosts, paths, params, API versions, methods).
Historical — things that used to exist (Wayback, old JS, deprecated /v1 APIs, backups).
Client-side — everything shipped to the browser/app (JS bundles, source maps, mobile APKs).

The scarce resource is unique surface. Anyone can run nuclei on the apex. Bounties live where enumeration is annoying: acquisition domains, per-tenant subdomains, internal tooling exposed by a misconfig, an API version the web UI no longer uses.

§Horizontal enumeration (find more roots)

# Seed roots from the scope, then pivot whois / ASN lookup → org-owned IP ranges (amass intel -org "Target", bgp.he.net) crt.sh → certs mentioning the org (SANs reveal sibling domains) reverse-whois → domains with same registrant email/org favicon hash (Shodan) → http.favicon.hash:<mmh3> finds all hosts serving the same app Google/GitHub → "© Target", copyright strings, internal tool names acquisitions → Crunchbase/Wikipedia; acquired companies inherit the bounty scope

Tells that a host is in-scope-adjacent: shared TLS cert SANs, shared favicon, shared analytics/GTM ID, shared error page, shared login SSO. Always confirm scope before testing.

§Vertical enumeration (drill into one app)

Subdomains

# Passive first (no traffic to target) subfinder -d target.com -all -recursive amass enum -passive -d target.com crt.sh?q=%25.target.com # cert transparency = free subdomain list # Then resolve + probe dnsx < subs.txt -a -resp # live A records httpx < subs.txt -title -tech-detect -status-code -cdn # Bruteforce the DNS for the ones passive missed puredns bruteforce best-dns-wordlist.txt target.com

Prioritize: dev. staging. uat. internal. admin. api. test. vpn. jira. git. — non-prod hosts skip auth/rate-limits and leak the most. Dangling CNAMEs → subdomain takeover (see attack-surface/subdomain-takeover — this is one of the highest-ROI recon findings).

Content & endpoints

# Crawl what's linked katana -u https://target.com -jc -d 3 gau target.com ; waybackurls target.com # historical URLs incl. dead endpoints & params # Bruteforce what isn't ffuf -w raft-large-directories.txt -u https://target.com/FUZZ -mc all -fc 404 # Pull params from history for later injection fuzzing gau target.com | unfurl keys | sort -u > params.txt

The single richest recon source: JavaScript

Modern SPAs ship their entire API surface to the client. Mine it:

# collect all JS katana -u https://target.com -jc | grep '\.js' | httpx -mc 200 > js.txt # extract endpoints, params, secrets cat js.txt | while read u; do curl -s "$u"; done > all.js grep -oE '"/[a-zA-Z0-9_/-]+"' all.js | sort -u # API paths grep -oiE '(api[_-]?key|secret|token|aws_|bearer)[^,]{0,40}' all.js # secrets # source maps rebuild original source (huge): curl -s https://target.com/app.js.map | npx source-map-explorer

Leaked API keys, internal hostnames, feature flags, and unreferenced admin endpoints all live here. (See vulnerabilities/info-disclosure for real cases of secrets-in-JS → escalation.)

§Historical enumeration

Wayback / gau — dead endpoints often still work and skip new auth checks. Old ?debug=,

?admin=, and legacy param names resurface here.

.git, .svn, backups — /.git/config, /.env, /backup.zip, /config.php.bak,

editor swap files (.php~, .swp). git-dumper reconstructs the repo from an exposed .git/.

Deprecated API versions — /api/v1/ may lack the authz the web UI's /api/v3/ enforces.

§API-specific recon

robots.txt / sitemap.xml / swagger.json / openapi.json / graphql introspection /.well-known/ # security.txt, openid config Guess docs: /api/docs /swagger-ui /redoc /graphiql

GraphQL: always test introspection (__schema) — even "disabled" introspection often leaks types via field-suggestion errors. See attack-surface/graphql.

§Mobile as recon

Decompile the APK/IPA — it is a signed manifest of the backend:

apktool d app.apk ; jadx app.apk grep -rE 'https?://|api|secret|firebase' sources/ # hardcoded hosts, keys, Firebase DBs

Mobile apps hit endpoints the web app never exposes, embed long-lived tokens, and disable pinning in debug builds. (See the mobile pages under attack-surface/.)

§Prioritization — where the bounties actually are

From the corpus, the endpoints that repeatedly pay:

URL/host-fetch params (url=, image=, webhook=, callback=, avatar_url=) → SSRF.
ID params (id=, uuid=, account=, /users/<id>/) → IDOR/BOLA.
Redirect params (next=, return=, redirect_uri=, continue=) → open redirect / OAuth theft.
Render/preview features (PDF export, screenshot, "import from URL", markdown preview) → SSRF/XSS/XXE.
File upload + processing (avatars, attachments, import) → upload RCE, XXE, image parsers.
Admin/tooling subdomains and staging hosts → auth bypass, debug endpoints, verbose errors.

§Recon hygiene

Stay in scope; confirm acquisitions are covered before touching them.
Passive before active. Don't brute-force production login/reset flows during recon.
Keep a per-target notes file: hosts, tech, interesting params, and questions to answer next.
Recon output feeds the vuln-class pages: pipe discovered params into the detection probes there.

§References

Cross-links: methodology/choosing-targets.md, attack-surface/subdomain-takeover.md,

attack-surface/graphql.md, vulnerabilities/ssrf/, vulnerabilities/info-disclosure/.

Reference books: Bug Bounty Bootcamp (ch. Recon), Real-World Bug Hunting.
Corpus case studies that begin with superior recon are cited on each class page.