---
name: Recon Methodology
slug: recon-methodology
category: Automation
description: Recon Methodology outlines passive and light active steps for bug bounty recon, including subdomain enumeration, URL discovery, tech detection, and content discovery. Use it to organize findings and extract IDOR and SSRF candidates.
github: "https://github.com/H-mmer/pentest-agents/tree/main/skills/recon-methodology"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/recon-methodology ~/.claude/skills/recon-methodology"
installs_to: ~/.claude/skills/recon-methodology
source_path: skills/recon-methodology/SKILL.md
collection_size: 25
category_size: 1523
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:31.842Z
last_synced: 2026-08-22T05:22:31.842Z
canonical_url: "https://dirskills.com/skills/recon-methodology"
---

# Recon Methodology

Recon Methodology outlines passive and light active steps for bug bounty recon, including subdomain enumeration, URL discovery, tech detection, and content discovery. Use it to organize findings and extract IDOR and SSRF candidates.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/recon-methodology ~/.claude/skills/recon-methodology
```

## README

# Recon Methodology

## Phase 1: Passive (no direct contact)

### Subdomain Enumeration
```bash
subfinder -d target.com -silent -all | sort -u > subs.txt
httpx -l subs.txt -silent -status-code -tech-detect | tee live-hosts.txt
```

### URL Discovery
```bash
gau target.com | sort -u > historical-urls.txt
waybackurls target.com | sort -u >> historical-urls.txt
grep -E "\?.*=" historical-urls.txt > params.txt
grep -iE "api|admin|internal|debug|test|staging" historical-urls.txt > interesting.txt
```

### Tech Detection
```bash
curl -sI https://target.com | grep -iE "server|x-powered|x-runtime|x-generator"
```

## Phase 2: Active (light contact)

### Content Discovery
```bash
ffuf -u https://target.com/FUZZ -w wordlists/common.txt -mc 200,301,302,403
ffuf -u https://target.com/api/FUZZ -w wordlists/api-endpoints.txt -mc 200,401,403,405
```

### JS Analysis
```bash
katana -u https://target.com -d 3 -jc -ef css,png,jpg,gif | grep "\.js$" | sort -u > js-files.txt
# Grep for secrets and endpoints in downloaded JS
grep -rohE '/api/[a-zA-Z0-9/_-]+' downloaded-js/ | sort -u
```

## Phase 3: Organize

### Key Output Files
```
recon/<target>/
├── live-hosts.txt       — verified live hosts with tech
├── urls.txt             — all discovered URLs
├── api-endpoints.txt    — API paths
├── js-analysis.txt      — secrets and endpoints from JS
├── idor-candidates.txt  — URLs with ID parameters
├── ssrf-candidates.txt  — URLs with URL/redirect parameters
└── tech-stack.txt       — technology summary
```

### Extract Candidates
```bash
# IDOR candidates:
grep -E '/[0-9]+|id=|user_id=|order_id=' urls.txt > idor-candidates.txt
# SSRF candidates:
grep -iE 'url=|uri=|redirect=|next=|dest=|callback=' urls.txt > ssrf-candidates.txt
```

After recon: run `/surface` for P1/P2/Kill ranking.