Crafting Your Reconnaissance Strategy

Welcome to the final lesson of your course on becoming a professional penetration tester and bug bounty hunter!

Throughout this journey, we have covered a vast amount of ground. You've learned to set up your lab, perform reconnaissance, exploit network and web vulnerabilities, escalate privileges, and, in our last lesson, articulate your findings professionally by assigning a CVSS score. Now, it's time to assemble all these pieces into a coherent, repeatable strategy.

This lesson's outcome is to develop a personal methodology for approaching a new target in a bug bounty or penetration testing engagement. A solid methodology is what separates amateurs from professionals. It's your blueprint for turning the chaos of a new target into a structured hunt, ensuring you are efficient, thorough, and effective.

1. What is a Methodology?

A methodology is more than just a checklist; it's a framework for thinking. It guides you through a logical progression of phases, from understanding the target to discovering vulnerabilities. It should be:

• Structured: It has defined phases (e.g., reconnaissance, analysis, exploitation).
• Flexible: You should be able to adapt it to different types of targets and scopes.
• Iterative: Findings in a later phase often feed back into an earlier one. For example, discovering a new subdomain during analysis sends you back to reconnaissance.

Many top-tier hackers have shared their methodologies, and one of the most respected is Jason Haddix's "The Bug Hunter's Methodology." His approach is incredibly practical and forms the foundation of what we will discuss today.

2. The Mindset of a Hunter

Before diving into tools and techniques, it's crucial to address the psychological aspects of hacking. A new, large, or high-profile target can be intimidating.

The final point is the most important. Many bugs are found in functionality that is only accessible after logging in. Your methodology must push you beyond the surface.

3. Phase 1: Broad Reconnaissance - Mapping the Attack Surface

The goal of reconnaissance is to go from a small set of initial targets (like company.com) to a comprehensive map of the organization's entire digital footprint. This is a breadth-first process where quantity is key.

The following video is a masterclass in this process. Jason Haddix performs a live recon session, demonstrating a powerful, tool-driven workflow.

Advanced Reconnaissance Techniques

The techniques in the video will give you 90% of the attack surface. To get the remaining 10%, you can use what Haddix calls "lossy methods." These are noisy and require more manual work but can uncover apex domains that automated tools miss.

4. Phase 2: Deep Analysis - Choosing Your Battles

Once you have a list of live web applications, the goal shifts from breadth to depth. It's impossible to manually test thousands of sites. You must prioritize and dig deep into the most promising ones. This is where your computer science background and JavaScript analysis skills will shine.

This phase combines quick automated checks with deep manual analysis.

5. Assembling Your Personal Methodology

Now, let's synthesize this into a structured, personal workflow. A mind map (like XMind, used by Haddix) or a simple text file in a project folder is excellent for tracking your progress.

Here is a template you can adopt and refine. For a list of specific tool commands, the "Bug Bounty Hunting Methodology 2025" GitHub repository is an excellent quick reference.

My Bug Bounty Methodology v1.0

Phase 0: Scoping and Setup

1. Read the program policy thoroughly. Identify all in-scope root domains, IPs, and applications. Note explicit out-of-scope targets and vulnerability types.
2. Create a dedicated project directory.
3. Start a mind map or notes file (e.g., officedepot.xmind).

Phase 1: Reconnaissance (Breadth-First)

1. Seed Expansion:
   • List primary root domains from the policy.
   • Find acquisitions (Crunchbase, Wikipedia).
   • Find ASNs (bgp.he.net, amass intel -org).
   • Advanced: Use reverse lookups (NS, DMARC, CSP) for more apex domains.
2. Subdomain Enumeration:
   • Run subfinder and amass on all discovered root domains.
   • Perform GitHub dorking for subdomains and secrets.
3. Live Host Discovery:
   • Combine all subdomains into a single list, sort, and unique.
   • Run httpx to probe for live web servers.
   • Run eyewitness or aquatone on the live hosts for visual identification.

Phase 2: Triage and Prioritization (Depth-First)

1. Initial Vulnerability Scanning:
   • Run nuclei with templates for CVEs, default logins, and subdomain takeovers against all live hosts. This may yield quick wins.
2. Visual Triage & Target Selection:
   • Review the screenshots. Identify 3-5 of the most promising targets (e.g., custom login portals, old-looking apps, apps with interesting names like dev-api, vpn).
3. Technology Profiling:
   • On your selected targets, use wappalyzer (browser) or webanalyze (CLI) to identify the tech stack.

Phase 3: Deep Dive (Manual Analysis)
For each of your 3-5 selected targets:

1. Content Discovery: Run recursive directory/file brute-forcing with feroxbuster or ffuf using technology-appropriate wordlists (e.g., from SecLists or Assetnote).
2. Spidering & JS Analysis:
   • Proxy traffic through Burp Suite. Authenticate and browse the entire application to map its functionality.
   • Use Burp extensions (gap, JS Link Finder) or xnlinkfinder to extract all endpoints and parameters from JavaScript files.
3. Manual Testing:
   • Apply the knowledge from this course!
   • Heat Map: Focus on high-risk areas: user profiles, file uploads, admin functions, API endpoints, integrations, password resets.
   • Parameter Analysis: Use gf patterns to identify and test parameters likely vulnerable to SQLi, XSS, IDOR, LFI, etc.
   • Ask key questions: How are users referenced (id=123)? Can I bypass authorization? What is the business logic?

Phase 4: Reporting

1. If a vulnerability is found, confirm its impact.
2. Write a professional report (Title, Summary, PoC, Impact, Remediation).
3. Calculate and include the CVSS vector and score.

This entire process is captured well by the "Two-Eye" Approach mentioned in the "Bug Bounty Hunting Methodology 2025" resource:

• First Eye: Systematic, automated, broad checks (nuclei, subdomain enumeration).
• Second Eye: Creative, manual, deep focus on "interesting" findings that require human intuition.

Test your understanding!

You are approaching a new bug bounty target, megacorp.com. Their program scope is *.megacorp.com. During your initial httpx and eyewitness scan, you find two interesting subdomains:

1. portal.megacorp.com: A modern-looking, single-page application built with React.
2. old-intranet.megacorp.com: An old-looking PHP application from 2009 with a simple login form.

Based on the methodology, what would be your immediate next steps for each of these targets? How would your approach differ between them?

Show answer

Your approach should adapt to the technology stack of each target.

1. For portal.megacorp.com (Modern React App):

   • Focus on Client-Side & APIs: Since it's a single-page application, the core logic is in the JavaScript and the APIs it calls.
   • JS Analysis is critical: Run xnlinkfinder or use Burp's gap extension to aggressively parse the JavaScript bundles. Look for API endpoints, hidden routes, and hardcoded keys.
   • API Fuzzing: Map out the API endpoints discovered. Test them for authorization flaws (IDOR, Broken Access Control), business logic issues, and injection vulnerabilities like SQLi or NoSQL injection if it's interacting with a database.
   • DOM XSS: Analyze the client-side code for potential DOM-based XSS, as React apps can be vulnerable if they use functions like dangerouslySetInnerHTML.

2. For old-intranet.megacorp.com (Old PHP App):

   • Focus on Server-Side & Common Vulns: Old, likely legacy code is a prime target for classic server-side vulnerabilities.
   • Aggressive Content Discovery: Run feroxbuster or dirsearch with a comprehensive PHP wordlist (e.g., from SecLists). Look for forgotten backup files (.bak, .old), exposed config files (config.php.bak), and old admin panels.
   • Classic Injection Attacks: Manually test all input fields and URL parameters for classic SQL Injection, Command Injection, and Local/Remote File Inclusion (LFI/RFI).
   • Authentication Bypass: Test the login form for SQLi bypasses, weak credentials, or other authentication flaws.
   • Known CVEs: Use nuclei to scan for vulnerabilities specific to the identified PHP version or any underlying framework.

The key difference is the focus: the React app requires a deep dive into the client-side code and APIs, while the old PHP app warrants a thorough search for classic server-side vulnerabilities and misconfigurations.

Conclusion

Congratulations on completing this course! You have journeyed from foundational concepts to the advanced strategies used by professional security researchers.

Developing a personal methodology is the capstone of this entire process. It's the engine that will drive your hunting and testing engagements. It provides structure to your creativity and ensures that you are both thorough and efficient. Remember, this is your methodology—it should evolve as you learn new techniques, discover new tools, and gain more experience.

Key Takeaways:

• A methodology is a structured but flexible framework, not a rigid script.
• A great methodology balances broad, automated reconnaissance with deep, manual analysis.
• Start broad to map the entire attack surface, then narrow your focus to the most promising targets.
• Document your process and findings, using tools like mind maps to keep track of your exploration.
• Your methodology is a living document. Continuously refine it with every target you test.

You now possess the knowledge and the strategic blueprint to begin your career. The next step is to take this methodology and apply it. Start with a public bug bounty program, perhaps one with a vulnerability disclosure policy (VDP) that allows for safe testing, and begin your hunt. Good luck