If you've ever watched top bug bounty hunters at work, you know the magic isn't just in finding the bug—it's in finding the hidden assets no one else even knows exist. The internet only knows what it knows, and if you only rely on a few basic commands, you are competing with thousands of other hunters for the exact same low-hanging fruit.
So, how do the pros actually map out a target? I recently analyzed NahamSec's entire recon methodology, and it completely reframes how you should look at attack surface management. Let's break down the ultimate reconnaissance workflow step-by-step, exactly as the experts do it.
Step 1: Passive Subdomain Discovery
Everything starts with finding subdomains. The easiest and fastest way to do this is passively. Passive discovery means you aren't actually touching the target company's servers yet. Instead, you ask public databases, search engines, and certificate logs what they know about the target.
The go-to tool for this is Subfinder. If you haven't used it, read our deep dive in the Subfinder Passive Recon Guide. Subfinder is essentially a cheat code. Instead of manually checking sources like Shodan, VirusTotal, or crt.sh, Subfinder fires off API requests to all of them simultaneously.
# Run Subfinder against a target and output to a text file subfinder -d example.com -all -o passive-subdomains.txt
In seconds, you get a massive text file packed with thousands of potential subdomains.
Step 2: DNS Probing (Separating the Alive from the Dead)
Here is the catch with passive discovery: a lot of those subdomains are dead. Companies spin up temporary dev servers and tear them down days later, but the public records remain forever. If you try to run heavy web scanners on a million dead domains, you will sit there for weeks. We need to filter out the noise.
Visualizing the flow from passive discovery into active DNS probing and resolution.
This is where DNS Probing comes in. Using a lightning-fast tool like pureDNS, we take that massive list and check which subdomains actually resolve to an IP address.
# Resolve the massive list of subdomains using trusted resolvers puredns resolve passive-subdomains.txt -r resolvers.txt -w resolved-alive.txt
PureDNS chews through hundreds of thousands of domains in seconds and spits out a clean list of targets that actually connect to the internet. For more tool options at this stage, check out our Subdomain Enumeration Tool Roundup.
Step 3: Active DNS Fuzzing
Now we shift from passive to active. The public internet does not know everything. If a developer spun up admin-staging.target.com five minutes ago, it won't be on Subfinder yet.
To find these hidden gems, we actively brute-force using wordlists. We take a massive wordlist—think millions of words like dev, api, backup, test—and ask the internet if those domains exist. If you notice a specific naming convention (like eu.target.com), you can specifically brute-force those sub-levels to dig even deeper.
Step 4: DNS Permutations
This is where you start finding the really obscure stuff. Imagine you found api-dev.target.com. A tool like AlterX takes that known domain and generates smart permutations.
It guesses things like api-staging.target.com, api-dev-backup.target.com, or api-prod.target.com. By creating these dynamic combinations based on data you already know exists, you discover unique assets that traditional brute-forcing completely misses.
Step 5: Expanding the Attack Surface (Root Domains)
Subdomains are great, but what if the company bought another startup last week? That entirely new domain is now part of your attack surface!
Top hunters use tools like Crunchbase to track recent company acquisitions. If the bug bounty program's scope says "All subsidiaries are in scope," you just hit the jackpot. You can also use Reverse WHOIS lookups or check SSL certificates on Shodan to find other root domains registered by the exact same organization. Once you find these new root domains, loop them right back into Step 1 and repeat the process.
Step 6: Public Exposure Probing
Alright, so you have a massive, perfectly filtered list of alive subdomains and root domains. Now what? You need to know what is actually running on them. We use HTTPX for this.
HTTPX scanning the resolved domains to extract critical metadata and tech stacks.
HTTPX acts like a scout. You feed it your giant list of live domains, and it rapidly pings all of them on standard web ports (like 80 and 443). It extracts the title of the page, the status code, the IP address, and detects the underlying technologies (like React, PHP, or WordPress).
# Probe for active web servers and extract titles, tech stacks, and status codes httpx -l resolved-alive.txt -sc -title -tech-detect -o httpx_results.txt
Instead of manually clicking through a thousand empty pages, HTTPX gives you a neatly organized file. You can instantly filter for all servers returning a 200 OK status code, or filter for specific outdated technologies, and start your manual hacking right there. If you want to dive deeper into this specific stage, our Modern Web Recon Workflow covers HTTP probing extensively.
The Wrap Up
Reconnaissance isn't just about running a single tool; it is about building an automated, repeatable pipeline. By chaining Subfinder, pureDNS, AlterX, and HTTPX together, you transform a single domain name into an expansive, target-rich environment. Set up your terminal, build your workflow, and go find those hidden assets! (Always remember to stay strictly within authorized testing scopes!)
Related Blogs
References / Further reading
- Subfinder GitHub Repository - ProjectDiscovery
- pureDNS GitHub Repository - d3mondev
- AlterX GitHub Repository - ProjectDiscovery
- HTTPX GitHub Repository - ProjectDiscovery
