5 recon habits that still land your first $500 bug bounty

Hi everyone, I am Nitin Gavhane and In this blog I want to walk through five recon habits that keep working for beginners, even as the payout numbers everyone quotes keep shifting under our feet.

Read this blog Free here.

Here is the honest starting point. HackerOne says its programs paid out $81 million to researchers over the past year, up 13% year over year. That is the headline number people share. What gets shared less is that roughly 40% of researchers who submit at least one report on the platform never get paid at all, based on one analysis of HackerOne's own public researcher data. That number is worth sitting with for a second. And when HackerOne cut its Internet Bug Bounty program's default low severity reward from $597 to $68 this past May, it was a reminder that reward tables move, sometimes overnight, and usually without much warning to the people relying on them.

None of that means bounty hunting is a dead end. It means the habits that get you a valid, reportable finding matter more than whatever dollar figure is trending on X this week. A realistic first paid report for most beginners still lands somewhere between $200 and $500, for a low or medium severity bug on a public program. Getting there is less about finding a zero day and more about doing the boring parts of recon that most people skip.

These five habits are not new. They are just the ones that keep paying off.

Map every subdomain a target has

A company's real attack surface rarely stops at www.company.com. There is api.company.com, staging.company.com, the admin panel someone spun up for a demo two years ago, and the login page from a startup they acquired and never fully decommissioned. The flagship app is usually locked down. The forgotten subdomain almost never is.

Start passive so you are not sending any traffic to the target yet. Certificate transparency logs at crt.sh are a good first stop, since every TLS certificate a company requests gets logged publicly. Pair that with subfinder, which pulls from dozens of passive sources at once:

subfinder -d target.com -all -o subs.txt

subfinder -d target.com -all -o subs.txt

Add amass in passive mode for a slower, deeper pass on high value targets, then merge and deduplicate both lists before you probe anything live with httpx. The goal at this stage is coverage, not speed.

Chase every dangling CNAME for a takeover

A subdomain takeover happens when a DNS record still points to a service the company stopped using, an old S3 bucket, a deprovisioned Heroku app, a GitHub Pages site that got deleted. If you can claim that same resource under your own account, the subdomain effectively becomes yours, and that is a clean, easy to prove report.

Once you have your subdomain list resolved, check the CNAME records and look for ones pointing at cloud services:

dig CNAME staging.target.com

dig CNAME staging.target.com

If the CNAME points somewhere like a S3 bucket or a Heroku app and the resource does not exist anymore, tools like subzy will flag it automatically across a whole list of subdomains. This is one of the few bug classes where a beginner with almost no exploitation skill can produce a fully working proof of concept in an afternoon, because the proof is just registering the same resource name and showing you now control the page.

Pull historical URLs and read the ones nobody is looking at

Old URLs do not disappear just because the app moved on. Wayback Machine, CommonCrawl, and OTX have all crawled a target's site at some point, and tools like gau and waybackurls pull that history back for you.

cat subs.txt | gau --threads 200 > urls.txt
grep '?' urls.txt | grep -viE '\.(png|jpg|jpeg|gif|css|svg|woff)' > urls_with_params.txt

cat subs.txt | gau --threads 200 > urls.txt
grep '?' urls.txt | grep -viE '\.(png|jpg|jpeg|gif|css|svg|woff)' > urls_with_params.txt

Most of what comes back is noise, images, stylesheets, dead pages. Filter that out first, then look specifically for old API versions such as /v1/ next to a current /v2/, admin routes that never got removed from a sitemap, and parameters that hint at internal functionality.

Treat JS files like source code, not just a secrets grep

Most beginners run one secret scanner, get nothing back, and move on to the next target. Trufflehog and similar tools catch the obvious stuff, an exposed AWS key, a hardcoded token, and that is worth running. But the more consistent finds come from opening the JavaScript files a target ships and reading them the way you would read someone else's source code.

Pull the live JS files with httpx or katana, then open the interesting ones by hand:

katana -list live_hosts.txt -jc -d 3 -silent | grep '\.js$' > js_files.txt

katana -list live_hosts.txt -jc -d 3 -silent | grep '\.js$' > js_files.txt

Look for internal API routes that are not yet linked anywhere in the visible UI, role checks written in plain JavaScript that a request can bypass entirely on the backend, and feature flags that hint at functionality still being tested. This takes longer than running a tool and walking away. That is exactly why most people skip it. It is also why it still works.

Re-run your recon on a schedule instead of once

A scan you run once tells you what a target looked like on that day. New subdomains, new endpoints, and new deployments show up constantly, and they are disproportionately more likely to be misconfigured, because whoever pushed them has not had time to lock them down yet.

You do not need anything elaborate to catch this. A daily cron job running subfinder and diffing the output against yesterday's list will flag new assets the moment they appear:

subfinder -d target.com -silent > today.txt
diff yesterday.txt today.txt

subfinder -d target.com -silent > today.txt
diff yesterday.txt today.txt

Where this leaves you

None of these five habits requires an exploit chain, a fuzzer, or six months of specializing in one vulnerability class. They require you to look at the parts of a target that everyone else scrolls past. [Insert your own first bounty story here, including which of these habits led to it, once you have one you can share with real numbers attached.]

Which of these do you already build into your recon, and which one have you been putting off? I want to know what is working for people right now.