Build a clean scope
Organize scope, domains, subdomains, DNS, HTTP, ports, URLs, JavaScript, parameters, APIs, content discovery, interesting findings, and screenshots into a predictable working structure.
CYBERSECURITY • RECON
Recon Methodology
A structured bug-bounty workflow for turning scope into attack surface, attack surface into functionality, and functionality into testable vulnerability hypotheses.
Authorized TestingBug BountyBurp SuiteAttack Surface Mapping
THE COMPLETE WORKFLOW
Recon is a loop, not a one-time phase.
The workflow starts with program rules and scope, builds outward through passive discovery and application mapping, then loops back whenever testing reveals new hosts, routes, parameters, or functionality.
Read Rules→
Build Scope→
Discover→
Resolve→
Probe→
Fingerprint→
Crawl→
Analyze→
Classify→
Score→
Test
Passive subdomain discovery
Gather subdomains, normalize them, and immediately flag higher-value names such as API, admin, internal, dev, staging, auth, files, upload, webhook, proxy, GraphQL, legacy, and backup.
DNS resolution
Separate names that merely exist in passive sources from names that resolve today. Keep unresolved assets too because they may still reveal historical infrastructure or dangling resources.
HTTP probing
Identify live web applications and keep more than just 200 responses. Redirects, 401s, 403s, 405s, 400s, and 500s can expose valuable application behavior.
Technology classification
Determine what you are actually looking at: framework, CMS, web server, CDN/WAF, authentication system, API architecture, cloud provider, JavaScript framework, and backend hints.
Crawl important applications
Use manual browsing through Burp and targeted crawling to collect URLs, parameters, forms, XHR/fetch traffic, JavaScript, APIs, uploads, downloads, redirects, callbacks, GraphQL, and WebSockets.
Historical endpoint discovery
Compare current crawl data with historical sources. Endpoints that only appear historically can reveal old APIs, legacy functionality, removed parameters, admin panels, exports, callbacks, and debug behavior.
JavaScript reconnaissance
Search JavaScript for application functionality—not merely secrets. Look for routes, parameters, feature flags, GraphQL operations, WebSockets, source maps, storage buckets, OAuth flows, URL processing, redirects, and file functionality.
API discovery
Create a separate API inventory and classify endpoints by operation. Knowing whether something is GET, POST, PUT, or DELETE immediately helps frame authorization, ownership, mass-assignment, and method-handling questions.
Parameter discovery
Prioritize dynamic endpoints and compare baseline behavior against requests with random or interesting parameters. Avoid wasting time on static assets that are unlikely to process additional input.
Content discovery
Do technology-aware discovery after fingerprinting. Generic wordlists have a place, but framework-specific paths produce less noise and more meaningful results.
Functionality mapping
Classify endpoints by what they do—URL fetch, redirect, upload, download, object access, admin, search, import, webhook, template rendering, OAuth, postMessage, or GraphQL—and map those behaviors to the most plausible bug classes.
URL-processing branch
Prioritize functions that appear to make the server retrieve remote resources, including previews, webhooks, imports, feeds, PDF generation, image fetching, avatar imports, document conversion, integrations, and callbacks.
Client-side branch
Inventory client-side inputs and message handlers, then trace them toward sinks, navigation, DOM manipulation, authentication actions, or network requests.
Access-control branch
Mark object identifiers, admin functionality, organization boundaries, invites, roles, private documents, account settings, and exports. Test authorization with accounts you are permitted to use.
Interesting response mining
Treat Burp history like a searchable database. Mine it for admin, internal, debug, stage, upload, download, callback, proxy, GraphQL, API, Swagger/OpenAPI, stack traces, internal hosts, and unusual error behavior.
Score the attack surface
Give more weight to authentication, admin, URL-fetching, file processing, payments, APIs, uploads, webhooks, object IDs, legacy/staging systems, interesting JavaScript, and unusual methods or errors.
Recon → Vulnerability matrix
Turn the final recon output into a map of authentication, APIs, URL processing, file processing, authorization, and client-side behavior so the next test is driven by functionality rather than guesswork.
FUNCTIONALITY → HYPOTHESIS
Turn application behavior into focused testing.
URL fetch / webhook / import→ SSRF / parser behavior
/user/{id} / object endpoint→ IDOR / access control
Upload / file processing→ validation / processing flaws
postMessage listener→ origin validation / DOM behavior
?redirect= / OAuth callback→ redirect / OAuth logic
/render / template functionality→ server-side template behavior
GraphQL→ object authorization / excessive exposure
THE CORE IDEA
Recon → Map Functionality → Form Hypothesis → Test
When testing reveals new information, go back to recon. When it does not, move to the next target or hypothesis.
RECON→MAP FUNCTIONALITY→FORM HYPOTHESIS→TEST→NEW INFORMATION?