The Ultimate Bug Bounty Recon Workflow: Mapping Attack Surfaces

If you've ever watched top bug bounty hunters at work, you know the magic isn't just in finding the bug—it's in finding the hidden assets no one else even knows exist. The internet only knows what it knows, and if you only rely on a few basic commands, you are competing with thousands of other hunters for the exact same low-hanging fruit.

So, how do the pros actually map out a target? I recently analyzed NahamSec's entire recon methodology, and it completely reframes how you should look at attack surface management. Let's break down the ultimate reconnaissance workflow step-by-step, exactly as the experts do it.

Step 1: Passive Subdomain Discovery

Everything starts with finding subdomains. The easiest and fastest way to do this is passively. Passive discovery means you aren't actually touching the target company's servers yet. Instead, you ask public databases, search engines, and certificate logs what they know about the target.

The go-to tool for this is Subfinder. If you haven't used it, read our deep dive in the Subfinder Passive Recon Guide. Subfinder is essentially a cheat code. Instead of manually checking sources like Shodan, VirusTotal, or crt.sh, Subfinder fires off API requests to all of them simultaneously.

# Run Subfinder against a target and output to a text file
subfinder -d example.com -all -o passive-subdomains.txt

In seconds, you get a massive text file packed with thousands of potential subdomains.

Step 2: DNS Probing (Separating the Alive from the Dead)