Comprehensive Recon Guide

Seed domains
  ↓ passive + active enumeration
Subdomains
  ↓ dnsx resolve + httpx probe
Live hosts
  ↓ naabu/masscan port scan
Open services
  ↓ katana + waybackurls + gau crawl
URLs
  ↓ unfurl / gf / LinkFinder
Parameters, endpoints, secrets
  ↓ ffuf / nuclei / manual review
Attack surface map

## Find other domains owned by the same org
amass intel -org "Target Corp"
amass intel -whois -d target.com
amass intel -asn 13335
amass intel -cidr 192.0.2.0/24

## Reverse whois via viewdns.info or whoxy
curl -s "https://api.whoxy.com/?key=$KEY&reverse=whois&email=admin@target.com"

## Basic
subfinder -d target.com -silent -o subs.txt

## All sources (slower but more thorough)
subfinder -d target.com -all -recursive -silent

## From multiple domains
subfinder -dL seeds.txt -all -silent -o subs.txt

## JSON output for enrichment
subfinder -d target.com -oJ -o subs.json

## Pipe directly into httpx
subfinder -d target.com -silent | httpx -silent

## Passive
amass enum -passive -d target.com -o amass.txt

## Active (adds DNS brute, zone walks, name alterations)
amass enum -active -d target.com -brute -o amass.txt

## Include unresolvable (internal leak hints)
amass enum -d target.com -include-unresolvable

## Bulk scan multiple domains
amass enum -df seeds.txt -o amass-multi.txt

## Track changes over time
amass track -d target.com -dir recon-data

## Visualize as graph
amass viz -d3 -dir recon-data

## Intel pivots
amass intel -org "Target Corp"
amass intel -asn 13335
amass intel -addr 192.0.2.10
amass intel -cidr 192.0.2.0/24
amass intel -whois -d target.com

## crt.sh basic
curl -s "https://crt.sh/?q=%25.target.com&output=json" \
  | jq -r '.[].name_value' \
  | sed 's/\*\.//g' \
  | sort -u > crtsh.txt

## Historical wildcards
curl -s "https://crt.sh/?q=%25.%25.target.com&output=json" | jq -r '.[].name_value'

## Find email addresses in CT
curl -s "https://crt.sh/?q=%25@target.com&output=json" | jq -r '.[].name_value'

## Alternative: Censys, Facebook CT, Google CT API

{
  subfinder -d target.com -all -silent
  assetfinder --subs-only target.com
  amass enum -passive -d target.com
  chaos -d target.com -silent
  curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g'
} | sort -u > all-subs.txt

## Brute force with a wordlist
puredns bruteforce wordlist.txt target.com \
  --resolvers resolvers.txt \
  --write results.txt

## Resolve a list of guessed names
puredns resolve candidates.txt --resolvers resolvers.txt

## Resolvers file: public-dns.info/nameservers-all.txt

## dnsgen — pattern-based mutations
cat subs.txt | dnsgen - | puredns resolve -r resolvers.txt

## altdns
altdns -i subs.txt -o altdns.txt -w words.txt -r -s results.txt

## gotator — pattern permutator
gotator -sub subs.txt -perm words.txt -depth 1 -numbers 5 | puredns resolve

## Fetch and validate resolvers
wget https://raw.githubusercontent.com/trickest/resolvers/main/resolvers.txt
dnsvalidator -tL resolvers.txt -threads 200 -o validated.txt

## Resolve and drop dead entries
cat subs.txt | dnsx -silent -a -resp > resolved.txt

## Only return live subdomains
dnsx -l subs.txt -silent > live-dns.txt

## Wildcard detection
dnsx -l subs.txt -wd target.com -silent

## Retrieve CNAME chain (finds takeover candidates)
dnsx -l subs.txt -cname -resp -silent

## Grab multiple record types
dnsx -l subs.txt -a -aaaa -cname -mx -ns -txt -silent -json

## Basic alive check
cat live-dns.txt | httpx -silent > alive.txt

## Rich metadata (title, status, tech, IP, CDN)
httpx -l live-dns.txt -title -sc -td -ip -cdn -server -silent -o probe.txt

## Multiple ports
httpx -l live-dns.txt -p 80,443,8080,8443,8000,3000,5000,9000 -silent

## Screenshot every live host
httpx -l live-dns.txt -screenshot -silent

## Filter by status code
httpx -l live-dns.txt -mc 200,301,302,401,403 -silent

## Match content type
httpx -l live-dns.txt -mct "application/json"

## Tech detection (Wappalyzer dataset)
httpx -l live-dns.txt -td -silent -json | jq '.tech'

## Favicon hash for clustering (mmh3)
httpx -l live-dns.txt -favicon -silent

## Top 1000 ports
naabu -l alive.txt -top-ports 1000 -silent

## Full range
naabu -host target.com -p - -rate 5000

## Pipe into httpx
naabu -l alive.txt -top-ports 1000 -silent | httpx -silent

## Full port sweep on a CIDR
sudo masscan -p1-65535 192.0.2.0/24 --rate=10000 -oG masscan.out

## Specific high-value ports across large ranges
sudo masscan -p22,80,443,3306,5432,6379,8080,8443,9200,27017 \
  192.0.2.0/16 --rate=20000

## Service version + default scripts on discovered ports
nmap -sV -sC -p 22,80,443,8080 -iL hosts.txt -oA nmap-scan

## Top ports with aggressive OS detection
nmap -A -T4 --top-ports 1000 -iL hosts.txt

## Vulnerability scripts
nmap -sV --script vuln -iL hosts.txt

rustscan -a target.com --ulimit 5000 -- -sV -sC

22    SSH
80    HTTP
443   HTTPS
2375  Docker API (unauthenticated)
3000  Grafana, Node dev
3306  MySQL
3389  RDP
5000  Flask dev
5432  Postgres
5601  Kibana
6379  Redis
7001  WebLogic
8000  HTTP alt
8080  HTTP alt / Jenkins
8443  HTTPS alt
8888  Jupyter
9000  SonarQube / PHP-FPM
9200  Elasticsearch
9090  Prometheus
11211 Memcached
15672 RabbitMQ management
27017 MongoDB

## Standard crawl
katana -u https://target.com -d 5 -silent

## From a list
katana -list alive.txt -d 3 -silent -o urls.txt

## Headless with JS rendering
katana -u https://target.com -headless -system-chrome -silent

## Respect robots.txt, follow same-host only
katana -u https://target.com -iqp -fs rdn -silent

## Output JSON with request bodies
katana -u https://target.com -jc -silent -o urls.json

## Basic
echo target.com | waybackurls > wayback.txt

## From all subdomains
cat subs.txt | waybackurls | sort -u > wayback.txt

echo target.com | gau --threads 10 > gau.txt

## Filter by extension
echo target.com | gau --blacklist png,jpg,gif,css,woff | sort -u

echo https://target.com | hakrawler -d 3 -subs

{
  cat alive.txt | katana -silent -d 3
  cat subs.txt | waybackurls
  cat subs.txt | gau --threads 5
} | sort -u > all-urls.txt

## Filter to interesting URLs
cat all-urls.txt | grep -E "\.(json|xml|js|php|aspx|jsp|env|bak|config|sql)$"
cat all-urls.txt | grep -E "api/|admin|internal|debug|swagger|graphql"

cat all-urls.txt | gf ssrf     > ssrf-candidates.txt
cat all-urls.txt | gf xss      > xss-candidates.txt
cat all-urls.txt | gf sqli     > sqli-candidates.txt
cat all-urls.txt | gf redirect > redirect-candidates.txt
cat all-urls.txt | gf lfi      > lfi-candidates.txt
cat all-urls.txt | gf idor     > idor-candidates.txt

## From Wayback
echo target.com | waybackurls | grep -Ei "\.js(\?|$)" | sort -u > js.txt

## From katana
katana -u https://target.com -silent | grep -Ei "\.js(\?|$)" | sort -u >> js.txt

## Verify alive
cat js.txt | httpx -mc 200 -silent > live-js.txt

## Single file
python3 linkfinder.py -i https://target.com/app.js -o cli

## Batch
while read url; do
  python3 linkfinder.py -i "$url" -o cli
done < live-js.txt | sort -u > endpoints.txt

xnLinkFinder -i live-js.txt -sf target.com -d 3 -o endpoints.txt

python3 SecretFinder.py -i https://target.com/app.js -o cli

while read url; do
  python3 SecretFinder.py -i "$url" -o cli 2>/dev/null
done < live-js.txt | tee secrets.txt

curl -s https://target.com/app.js | grep -oE \
  "(api[_-]?key|apikey|secret|token|password|passwd|bearer|aws_access|private_key)[\"':= ]+[a-zA-Z0-9/+=_-]{16,}"

## Hardcoded IPs and internal hosts
curl -s https://target.com/app.js | grep -oE "(https?://)?[a-z0-9.-]*\.(internal|corp|local|intranet)"

## Feature flags
curl -s https://target.com/app.js | grep -oE '"[a-z_]*_(enabled|flag|debug)"'

## Route definitions
curl -s https://target.com/app.js | grep -oE '"/api/[a-zA-Z0-9/_-]+"'

cat live-js.txt | while read url; do
  curl -s "$url" | jsluice urls
done | sort -u > jsluice-urls.txt

## Basic directory fuzz
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301,302,403 -o ffuf.json

## With extensions
ffuf -u https://target.com/FUZZ -w raft-medium-words.txt \
  -e .php,.bak,.old,.zip,.tar.gz,.env,.config \
  -mc 200,301,302,403

## Virtual host fuzzing
ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subs.txt -fs 1234

## Recursive
ffuf -u https://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2

## Parameter fuzzing
ffuf -u https://target.com/api?FUZZ=test -w params.txt -fs 0

## Rate limited
ffuf -u https://target.com/FUZZ -w wordlist.txt -rate 50

feroxbuster -u https://target.com -w wordlist.txt -x php,html,txt,bak -d 3

## From a list of targets
feroxbuster --stdin -w wordlist.txt < alive.txt

## Filter by response size
feroxbuster -u https://target.com -w raft-large.txt -S 0,1234

gobuster dir -u https://target.com -w wordlist.txt -x php,html,txt
gobuster vhost -u https://target.com -w subs.txt
gobuster dns -d target.com -w dns-wordlist.txt

## Basic
arjun -u https://target.com/api/users

## With wordlist
arjun -u https://target.com/api/users -w params.txt

## From URL list
arjun -i urls.txt

## Methods
arjun -u https://target.com/api -m GET,POST

## Output
arjun -u https://target.com -oJ arjun.json

python3 paramspider.py -d target.com -o params.txt

x8 -u https://target.com/api -w params.txt

debug, test, admin, internal, trace, verbose
callback, jsonp, returnUrl, redirect, next, url, uri, path, file
id, userId, user_id, account, tenant, org, orgId
template, view, include, load, src, source, dest, target, action, cmd
token, auth, api_key, apikey, access_token, sso

httpx -l alive.txt -td -server -title -sc -silent -json | jq '.tech'

whatweb -a 3 https://target.com
whatweb -i alive.txt --log-json=whatweb.json

wappalyzer https://target.com

## Shodan by favicon hash
shodan search "http.favicon.hash:-1234567890"

## By HTTP title
shodan search 'http.title:"Jenkins"'

## By SSL cert subject
shodan search 'ssl.cert.subject.cn:target.com'

## Censys
censys search 'services.tls.certificates.leaf_data.subject.common_name: target.com'

## Generate permutations
cat <<EOF > bucket-perms.txt
target
target-dev
target-prod
target-staging
target-backup
target-backups
target-assets
target-media
target-uploads
target-logs
target-data
target-db
target-internal
target-private
target-public
target-test
target-qa
EOF

## Test each
while read b; do
  aws s3 ls "s3://$b" --no-sign-request 2>&1 | grep -v NoSuchBucket | grep -v AllAccessDisabled
done < bucket-perms.txt

s3scanner scan --bucket-file bucket-perms.txt
s3scanner scan --bucket target-backups --dump

python3 cloud_enum.py -k target -k targetcorp -k target-internal

## Azure blob URL pattern
https://<storage-account>.blob.core.windows.net/<container>/<blob>

## Enumerate containers
curl -s "https://target.blob.core.windows.net/?comp=list" | xmllint --format -

## List blobs in a container
curl -s "https://target.blob.core.windows.net/container?restype=container&comp=list"

## Public read check
curl -s "https://storage.googleapis.com/storage/v1/b/target-bucket" | jq .

## List objects
curl -s "https://storage.googleapis.com/storage/v1/b/target-bucket/o" | jq .

python3 cloudfail.py -t target.com

org:target password
org:target api_key
org:target aws_access_key_id
org:target BEGIN RSA
org:target smtp
org:target "internal-api"
org:target filename:.env
org:target filename:config
org:target extension:sql
org:target extension:pem

gitgot -q target.com
gitgot -q "target api_key" -o gitgot-results.json

## Scan a repo
trufflehog git https://github.com/target/repo

## Scan an org
trufflehog github --org=target --token=$GITHUB_TOKEN

## Verified secrets only (no false positives)
trufflehog github --org=target --only-verified

gitleaks detect --source . --report-format json --report-path gitleaks.json
gitleaks detect --source https://github.com/target/repo

github-subdomains -d target.com -t $GITHUB_TOKEN -o gh-subs.txt

## From a known IP
whois -h whois.cymru.com 192.0.2.10

## Via bgpview
curl -s "https://api.bgpview.io/ip/192.0.2.10" | jq .

## Interactive: bgp.he.net

## bgpview
curl -s "https://api.bgpview.io/asn/AS13335/prefixes" \
  | jq -r '.data.ipv4_prefixes[].prefix' > asn-ranges.txt

## amass intel
amass intel -asn 13335 > asn-hosts.txt

## Port scan the range
sudo masscan -iL asn-ranges.txt -p80,443,8080,8443 --rate=10000 -oG masscan.out

## HTTP probe
awk '/open/{print $4}' masscan.out | httpx -silent -title -sc -ip

## PTR lookups across a CIDR
prips 192.0.2.0/24 | dnsx -ptr -resp-only

## Docker Hub public repositories
curl -s "https://hub.docker.com/v2/repositories/target/?page_size=100" | jq '.results[].name'

## Amazon ECR public gallery
aws ecr-public describe-repositories --region us-east-1 --output table

## Google Container Registry
gcloud container images list --repository=gcr.io/target-project

## Azure Container Registry
az acr repository list --name targetregistry --output table

## Custom registry enumeration
curl -s https://registry.target.com/v2/_catalog | jq '.repositories'

## Pull and analyze container images
docker pull target/app:latest
docker history target/app:latest

## Extract filesystem without running
docker create --name temp target/app:latest
docker export temp | tar -tv | grep -E "\.env|config|secret"
docker rm temp

## Dive - analyze image layers
dive target/app:latest

## Trivy - vulnerability and secret scanning
trivy image target/app:latest

## AWS Lambda function enumeration
aws lambda list-functions --region us-east-1 --output table

## Generate Lambda function name permutations
cat <<EOF > lambda-names.txt
target-api
target-webhook
target-auth
target-processor
target-dev
target-staging
target-prod
EOF

## Test Lambda function URLs (if enabled)
while read name; do
  curl -s "https://$name.lambda-url.us-east-1.on.aws/"
done < lambda-names.txt

## Azure Function Apps
az functionapp list --output table

## Google Cloud Functions
gcloud functions list --region=us-central1

## API Gateway discovery for serverless backends
aws apigateway get-rest-apis --region us-east-1

## GitHub repository search for IaC files
gh search code --owner=target "filename:terraform" OR "filename:cloudformation"
gh search code --owner=target "resource \"aws_" OR "resource \"google_" OR "resource \"azurerm_"

## Extract resource names from Terraform
grep -r "resource \"" . | grep -E "(aws_|google_|azurerm_)" | cut -d'"' -f4

## CloudFormation template analysis
aws cloudformation list-stacks --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE

## Kubernetes manifest discovery
kubectl get all --all-namespaces
kubectl get ingress --all-namespaces
kubectl describe configmaps --all-namespaces | grep -A5 -B5 "target"

## Basic introspection query
curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{ __schema { types { name description } } }"}'

## Get all queries and mutations
curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{ __schema { queryType { fields { name description args { name type { name } } } } } }"}'

## GraphQL Voyager for schema visualization
## Visit: https://ivangoncharov.github.io/graphql-voyager/
## Or use GraphiQL: https://github.com/graphql/graphiql

## Batch introspection with graphql-introspect
npm install -g graphql-introspect
graphql-introspect https://target.com/graphql > schema.json

## Common GraphQL endpoints
/graphql
/graphiql
/api/graphql
/v1/graphql
/api/v1/graphql

## Common Swagger/OpenAPI paths
curl -s https://target.com/swagger.json
curl -s https://target.com/api-docs
curl -s https://target.com/openapi.json
curl -s https://target.com/docs/swagger.json
curl -s https://target.com/api/v1/swagger.json
curl -s https://target.com/swagger-ui/
curl -s https://target.com/redoc/

## Extract endpoints from OpenAPI spec
curl -s https://target.com/openapi.json | jq '.paths | keys[]'

## Swagger Codegen to generate client libraries
swagger-codegen generate -i https://target.com/swagger.json -l html2 -o swagger-docs

## openapi-directory search for known APIs
git clone https://github.com/APIs-guru/openapi-directory
grep -r "target.com" openapi-directory/

## gRPC reflection (if enabled)
grpcurl -plaintext target.com:50051 list
grpcurl -plaintext target.com:50051 list target.Service
grpcurl -plaintext target.com:50051 describe target.Service.Method

## gRPC-Web detection
curl -s https://target.com/api/grpc -H "Content-Type: application/grpc-web-text"

## Extract protobuf definitions
protoc --decode_raw < binary_message.bin

## Common gRPC ports
50051, 9090, 8080, 443 (gRPC-Web)

## WebSocket endpoint discovery
echo "ws://target.com:8080/ws" | websocat -n1
echo "wss://target.com/websocket" | websocat -n1

## Common WebSocket paths
/ws
/websocket
/socket.io/
/sockjs-node/
/live
/updates
/notifications

## Extract WebSocket endpoints from JavaScript
grep -r "WebSocket\|socket\.io" js-files/ | grep -oE "wss?://[^\"']+"

## Pattern-based subdomain generation using neural networks
## This represents the concept - actual implementation varies
python3 ml_subdomain_generator.py --domain target.com --patterns discovered_subdomains.txt

## GPT-based subdomain suggestions (conceptual)
## Extract patterns from known subdomains and generate likely candidates
cat known_subs.txt | python3 gpt_subdomain_suggester.py --model gpt-4

## Anomaly detection for interesting subdomains
python3 subdomain_anomaly_detector.py --input all_subs.txt --threshold 0.8

## Nuclei v3 with ML-based template matching
nuclei -l targets.txt -t . -severity low,medium,high,critical -ai-powered

## Custom ML models for false positive reduction
nuclei -l targets.txt -t custom-templates/ -ml-filter confidence=0.7

## Dynamic payload generation based on application context
nuclei -l targets.txt -dynamic-payloads -context-aware

## Real-time certificate transparency monitoring
certstream-monitor --domain target.com --webhook https://your-webhook.com/ct-alerts

## Automated asset correlation and risk scoring
python3 asset_correlator.py --domain target.com --risk-threshold high

## ML-based threat intelligence integration
python3 threat_intel_correlator.py --assets assets.json --sources virustotal,shodan,censys

## Axiom - distributed reconnaissance platform
axiom-scan targets.txt -m subfinder -o subfinder-results
axiom-scan live-targets.txt -m httpx --screenshot -o httpx-results

## Custom cloud worker deployment
## Deploy reconnaissance workers across multiple regions for speed and stealth
terraform apply -var="regions=['us-east-1','eu-west-1','ap-southeast-1']"

## Distributed port scanning
masscan-distributed --targets targets.txt --ports 1-65535 --workers 10

## Source map discovery
find . -name "*.js.map"
curl -s https://target.com/static/js/main.js.map

## Source map extraction and analysis
source-map-resolve main.js.map > original-sources/

## Extract API endpoints from unminified code
grep -r "api\/" original-sources/ | grep -oE "api/[a-zA-Z0-9/_-]+"

## Progressive Web App manifest analysis
curl -s https://target.com/manifest.json | jq '.'

## Service worker discovery and analysis
curl -s https://target.com/sw.js | grep -oE "fetch\('[^']+'"

Discovery/DNS/
  subdomains-top1million-5000.txt
  subdomains-top1million-110000.txt
  dns-Jhaddix.txt
  bitquark-subdomains-top100000.txt

Discovery/Web-Content/
  raft-small-words.txt
  raft-medium-words.txt
  raft-large-words.txt
  common.txt
  big.txt
  directory-list-2.3-medium.txt
  api/api-endpoints.txt

Discovery/Web-Content/CMS/
  wordpress.fuzz.txt
  joomla.fuzz.txt
  drupal.fuzz.txt

Fuzzing/
  LFI/
  XSS/
  SQLi/

Passwords/
  Common-Credentials/

best-dns-wordlist.txt              # 9M real subdomains, mined from CT/CC
httparchive_directories_*.txt      # Directories seen in HTTP Archive
httparchive_files_*.txt            # Files seen in HTTP Archive
cloud-s3-bucket-names.txt          # Real S3 bucket names
parameters_top_1M.txt              # Real HTTP parameters

## Collect every URL you've ever crawled
cat recon/*/urls.txt | unfurl paths | awk -F/ '{for(i=2;i<=NF;i++)print $i}' \
  | sort | uniq -c | sort -rn > my-dirs.txt

## Full subdomain enum
bbot -t target.com -f subdomain-enum

## Web spider + HTTP probe + tech detect
bbot -t target.com -f web-basic

## Everything (expensive)
bbot -t target.com -f subdomain-enum,web-basic,cloud-enum -o bbot-out/

recon-ng
> marketplace install all
> workspaces create target
> modules load recon/domains-hosts/hackertarget
> options set SOURCE target.com
> run

./reconftw.sh -d target.com -r    # recon only
./reconftw.sh -d target.com -a    # full scan

#!/usr/bin/env bash
set -euo pipefail
TARGET=$1
OUT=recon/$TARGET
mkdir -p "$OUT"

## 1. Subdomains
{
  subfinder -d "$TARGET" -all -silent
  assetfinder --subs-only "$TARGET"
  chaos -d "$TARGET" -silent
  curl -s "https://crt.sh/?q=%25.$TARGET&output=json" \
    | jq -r '.[].name_value' 2>/dev/null | sed 's/\*\.//g'
} | sort -u > "$OUT/subs.txt"

## 2. Resolve
dnsx -l "$OUT/subs.txt" -silent > "$OUT/resolved.txt"

## 3. HTTP probe
httpx -l "$OUT/resolved.txt" -silent -title -sc -td -ip -json \
  > "$OUT/httpx.json"
jq -r '.url' "$OUT/httpx.json" > "$OUT/alive.txt"

## 4. Port scan
naabu -l "$OUT/alive.txt" -top-ports 1000 -silent > "$OUT/ports.txt"

## 5. Crawl
{
  katana -list "$OUT/alive.txt" -silent -d 3
  cat "$OUT/subs.txt" | waybackurls
  cat "$OUT/subs.txt" | gau --threads 5
} | sort -u > "$OUT/urls.txt"

## 6. JS files
grep -Ei "\.js(\?|$)" "$OUT/urls.txt" | httpx -mc 200 -silent > "$OUT/js.txt"

## 7. gf classification
for pattern in ssrf xss sqli redirect lfi idor; do
  gf "$pattern" < "$OUT/urls.txt" > "$OUT/gf-$pattern.txt" || true
done

## 8. Nuclei scan
nuclei -l "$OUT/alive.txt" -severity low,medium,high,critical -silent \
  -o "$OUT/nuclei.txt"

echo "Done. Results in $OUT/"

#!/usr/bin/env bash
TARGET=$1
TODAY=$(date +%F)
OUT=recon/$TARGET/$TODAY
PREV=$(ls -1 recon/$TARGET | grep -v $TODAY | tail -1)

mkdir -p "$OUT"
subfinder -d "$TARGET" -all -silent | sort -u > "$OUT/subs.txt"

if [[ -f "recon/$TARGET/$PREV/subs.txt" ]]; then
  comm -13 "recon/$TARGET/$PREV/subs.txt" "$OUT/subs.txt" > "$OUT/new.txt"
  if [[ -s "$OUT/new.txt" ]]; then
    curl -X POST "$SLACK_WEBHOOK" -d "New subs for $TARGET: $(cat $OUT/new.txt)"
  fi
fi

subfinder -d target.com -all -silent \
  | anew subs.txt \
  | notify -silent -bulk -provider slack

## ProjectDiscovery toolkit
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
go install github.com/projectdiscovery/katana/cmd/katana@latest
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/projectdiscovery/chaos-client/cmd/chaos@latest
go install github.com/projectdiscovery/notify/cmd/notify@latest

## Other Go tools
go install github.com/tomnomnom/assetfinder@latest
go install github.com/tomnomnom/waybackurls@latest
go install github.com/tomnomnom/anew@latest
go install github.com/tomnomnom/gf@latest
go install github.com/tomnomnom/unfurl@latest
go install github.com/hakluke/hakrawler@latest
go install github.com/lc/gau/v2/cmd/gau@latest
go install github.com/ffuf/ffuf/v2@latest
go install github.com/OJ/gobuster/v3@latest

## Rust / Python
cargo install feroxbuster
pip install arjun xnLinkFinder

## Subs → alive → screenshots
subfinder -d target.com -all -silent \
  | dnsx -silent \
  | httpx -silent -screenshot

## Subs → crawl → JS → endpoints
subfinder -d target.com -all -silent \
  | httpx -silent \
  | katana -silent -d 3 \
  | grep -E "\.js$" \
  | xargs -I{} python3 linkfinder.py -i {} -o cli

## Subs → params → SSRF candidates
subfinder -d target.com -all -silent \
  | httpx -silent \
  | waybackurls \
  | gf ssrf > ssrf-candidates.txt

## Every URL ever crawled on every sub
subfinder -d target.com -silent \
  | gau --threads 10 --blacklist png,jpg,gif,css,woff \
  | sort -u > urls.txt

## Modern 2026 one-liners
## Container registry enumeration
curl -s "https://hub.docker.com/v2/repositories/target/?page_size=100" \
  | jq -r '.results[].name' | head -20

## GraphQL introspection discovery
echo '{"query": "{ __schema { types { name } } }"}' \
  | httpx -silent -mc 200 -path /graphql -method POST \
  | grep -E "(types|fields|mutations)"

## Source map hunting
cat urls.txt | grep -E "\.js$" \
  | sed 's/\.js/.js.map/g' \
  | httpx -silent -mc 200

## Serverless function name generation
echo -e "target-api\ntarget-webhook\ntarget-auth" \
  | sed 's/$/\-dev\n&\-staging\n&\-prod/' \
  | while read name; do curl -s "https://$name.lambda-url.us-east-1.on.aws/"; done

[ ] Scope captured in a file
[ ] Seed domains expanded via reverse whois / ASN
[ ] Passive subdomain enum run (subfinder, amass, chaos, crt.sh)
[ ] Active subdomain enum run (puredns brute + permutation)
[ ] All subdomains resolved via dnsx
[ ] All live hosts probed via httpx with -td
[ ] Screenshots captured for visual triage
[ ] Port scan run (naabu top-1000 minimum)
[ ] Crawl complete (katana + waybackurls + gau)
[ ] JS files extracted and mined with LinkFinder
[ ] Source maps (.js.map) discovered and analyzed
[ ] Secrets scan run on JS and source maps
[ ] Parameter discovery run (arjun) on high-value endpoints
[ ] gf patterns applied to URL corpus
[ ] Cloud buckets permuted and tested
[ ] Container registries enumerated (Docker Hub, ECR, GCR, ACR)
[ ] GraphQL introspection attempted on discovered endpoints
[ ] API documentation discovered (Swagger/OpenAPI, GraphQL)
[ ] Serverless function enumeration (Lambda, Azure Functions, Cloud Functions)
[ ] GitHub org scanned with trufflehog
[ ] Infrastructure-as-Code repositories analyzed
[ ] Nuclei baseline scan run with ML-powered templates
[ ] Certificate transparency monitoring configured
[ ] Nightly diff pipeline set up
[ ] All raw outputs archived for future re-use