Post cover image

July 23, 2026

Bug Bounty Automation — Elite Recon Pipeline + bonus Script

The mistake the beginners do is they approaches reconnaissance like a linear process. Handed a /16 subnet or a wildcard domain, they load…

By AYA

6 min read

The mistake the beginners do is they approaches reconnaissance like a linear process. Handed a /16 subnet or a wildcard domain, they load their automated scanners, hit "go," and drown in a flood of alerts, false positives, and blocked connections. They treat the network as a flat, linear checklist.

But a network is not a checklist; it is a fractal.

To truly map an organization's external attack surface, the researcher must understand that reconnaissance is an epistemological exercise — an iterative loop of separating signal from noise. You do not attack a whole/16 blindly; You exploit the asymmetry of information, using the target's own infrastructure to draw the map for you.

Here is an advanced, pentester's methodology for external network reconnaissance, moving from the silent observation of the perimeter to the kinetic interrogation of its core.

Fractal Recon : Extracting Signal from Network Randomness

Phase 1: Mapping the Perimeter (Passive Footprinting)

None

Before we send a single packet to the target's network, we must understand its footprint in the broader internet ecosystem. The tester should not touch the network immediately; only observes the shadows the network casts elsewhere.

We begin by querying the entities that map the internet for us. If the client operates within a specific ASN (Autonomous System Number), or owns the block 198.51.0.0/16, we query third-party aggregators (Shodan, Censys, BGP toolkits) to see what is already known.

  • The OSINT Sweep: Why scan 65,536 IPs for web servers in first when Censys has already done it?
shodan search --fields ip_str,port,org,hostnames net:198.51.0.0/16
https://platform.censys.io/search?q=host.ip%3A%22198.51.0.0%2F16%22
dig +short 198.51.0.0/16.origin.asn.cymru.com txt

This passive phase gives us a baseline. It reveals historical records, forgotten subnets, and the general shape of the architecture without triggering a single IDS alert.

Phase 2: Mapping the DNS Structure (Extracting the Map)

An IP address is merely a physical coordinate. DNS is the logical map that tells us what those coordinates mean. In this step we pivot from the network layer (IPs) to the application layer (DNS). Our goal here is horizontal expansion: finding every possible subdomain and authoritative record associated with the target (e.g., acme-corp.com) based on our manual search in the previous step.

  1. Observation: You see an HTTP/HTTPS service on port 443.
  2. Extraction: You pull the SSL certificate. openssl s_client -connect 198.51.x.x:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep DNS ///// OR curl -I ``[https://i](https://141.203.191.51)``p
  3. Discovery: The certificate says "Issued to: *.prod.acme-corp.com".
  4. Pivot: Now you have the root domain acme-corp.com.

We are looking for extreme asymmetry: the single misconfiguration that reveals the entire hidden structure.

  • The Authoritative Interrogation: We locate the servers responsible for the domain's routing.
dig NS acme-corp.com +short
  • The Zone Transfer (AXFR) Hail Mary: We test those nameservers for the ultimate fragility — a misconfiguration allowing us to download their entire zone file.
dig axfr @ns1.acme-corp.com acme-corp.com
  • Horizontal Brute-Forcing: If the administrators have skin in the game and the zone transfer fails, we brute-force the subdomains using a massive wordlist, cross-referencing against public resolvers.
dnsrecon -d targetcompany.com -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt

The Lindy Effect of Infrastructure: Pay close attention to the nomenclature you discover here. A server named api-v3 is modern and likely patched.. A server named legacy-vpn-2015 or test-oracle has survived in the shadows for years. These are the fragile nodes.

Phase 3: Kinetic Filtration (The Sweep)

Now, and only now, do we touch the target's physical IP space. We take the 198.51.0.0/16 block and our resolved DNS IP list. The goal is not deep inspection yet; the goal is extreme, rapid filtration. We must shave away the empty space. — it's about finding what else is hiding that you missed in the first pass; Attack Surface Mapping.

We use an asynchronous tool to blast the network, looking only for the most critical indicators of life (e.g., HTTP, HTTPS, SSH, DNS, SMB).

  • First, use the "Wide & Shallow" scan (the list of specific ports). This gives you a list of "hot" targets within 15 minutes. You start working on these immediately while the clock is ticking.
masscan -p21,22,53,80,443,445,3389,8443 -U:53,161 198.51.0.0/16 --rate=10000 --wait 0
  • Then, let the "Deep & Thorough" scan run in the background as a "background task." If it finds something new after 6 hours, you can add those targets to your workflow.
masscan -p1-65535 198.51.0.0/16 --rate=5000 --banners -oG all_open_services.gnmap

Now the 65,536 possibilities collapse into a tangible list of, say, 50 active hosts. We have eliminated the noise.

Phase 4: Deep enumeration (Probing for Fragility)

Phase 4 is where you shift from broad discovery to deep analysis. You have isolated the live hosts and their open ports in the masscan output, but masscan doesn't tell you what is running; it only tells you the door is unlocked.

Now, we use Nmap to interrogate those specific doors with precision.

# This cleans the masscan output and saves it as "targets.txt"
grep "open" all_open_services.gnmap | awk '{print $2":"$3}' | cut -d/ -f1 > targets.txt
nmap -sV -sC -Pn -T4 -O -iL targets.txt -oA targeted_deep_analysis
  • -sV (Version Detection): Uncovers the specific daemon (e.g., OpenSSH 7.2p2) rather than just assuming port 22 is standard SSH.
  • -sC (Script Scanning): Automates the extraction of SSL certificates, SMB shares, and HTTP titles.
  • -Pn: Crucial—you already know the hosts are alive from your masscan sweep. This saves time by skipping the ping/host-discovery phase.
  • -O: (OS Detection) This analyzes the quirks in how the target's TCP/IP stack responds to specific, non-standard probes (like malformed packets or specific sequence numbers). It compares these responses to a database to guess the OS and kernel version.

The goal shifts from merely knowing a device is on the network to understanding its function, attack surface, and operating system.

#alternatively
nmap -sn 198.51.0.0/16 -T4 --min-parallelism 100 -oG liveips.gnmap
nmap -sS -p- --min-rate 1000 -iL liveips -oG open_ports.gnmap
map -sV -sC -Pn -T4 -iL liveips -oA final_detailed_analysis
# This connects to every IP, grabs the cert, and extracts ONLY the domain names
cat liveips.txt | tlsx -san -cn -silent > extracted_domains.txt
#(If you don't have tlsx, you can use httpx with the -tls-probe flag).

Phase 5: The Fractal Return (Closing the Loop)

The "Fractal" nature of this phase is simple: Information yields more Information. This is the phase the amateur misses entirely. Reconnaissance is not a straight line; it is a continuous feedback loop. Every single discovery you make is a potential seed for the next round of reconnaissance.

When Nmap runs its default scripts (-sC) against an HTTPS port (443), it extracts the SSL/TLS certificate. That certificate often contains a Subject Alternative Name (SAN) field, listing other domains valid for that certificate.

Suddenly, while scanning 198.51.10.50, you extract a certificate that reveals dev.targetcompany-internal.net. You have just discovered a completely new root domain you didn't know existed in Phase 1. What do you do? You feed it back into the top of the funnel. You run DNS brute-forcing on this new domain, you resolve the new IPs, you run masscan on any newly discovered subnets, and the cycle repeats.

## Extract all domains from Nmap XML output
grep -h "subjectAltName" final_deep_analysis.xml | grep -oE "[a-zA-Z0-9.-]+\.[a-z]{2,}" | sort -u > new_domains.txt

Once you have new_domains.txt, you don't just sit on them. You immediately run them through your Phase 2 (DNS Enumeration) logic:

  • Resolve IPs: for d in $(cat new_domains.txt); do host $d; done
  • Brute-Force Subdomains:
subfinder -d $d -o subdomains.txt
dnsrecon -d $d -D /usr/share/wordlists/subdomains.txt -t brt
  • Sweep: Take the newly found IPs and run them through your masscan (Phase 3) and nmap (Phase 4) pipeline.

The Architecture of Reconnaissance

You are never "done" with recon. You are just waiting for the next piece of data to force you back to the start. The more you find, the more you have to hunt. That is the definition of a deep, high-quality assessment.

The mastery of reconnaissance lies not in knowing how to run a tool, but in understanding where you are in this cycle, and refusing to let the noise of a massive network distract you from the asymmetric signals hiding within it.

None

Bonus : the automator

This single bash script, which we'll call recon-loop.sh, automates the transition between the phases. It creates a structured workspace to ensure you don't lose data as you pivot between IP discovery, DNS mapping, and targeted interrogation.

#!/bin/bash
# Usage: ./recon-loop.sh <target_domain> <cidr_range>
DOMAIN=$1
SCOPE=$2
TIMESTAMP=$(date +%s)
WORKDIR="recon_${DOMAIN}_${TIMESTAMP}"
mkdir -p $WORKDIR
cd $WORKDIR
echo "[+] Phase 1 & 2: DNS & Scope Setup"
# Passive/Logic DNS setup
echo "Targeting: $DOMAIN | Scope: $SCOPE" > scope_info.txt
dig NS $DOMAIN +short > nameservers.txt
echo "[+] Phase 3: Kinetic Filtration (Sweep)"
# Perform the "Wide & Shallow" sweep
masscan -p21,22,53,80,443,445,3389,8443 -U:53,161 $SCOPE --rate=10000 --wait 0 -oG masscan_results.gnmap
grep "open" masscan_results.gnmap | awk '{print $2":"$3}' | cut -d/ -f1 | sort -u > targets.txt
echo "[+] Phase 4: Precision Interrogation"
# Targeted Nmap scan
nmap -sV -sC -Pn -T4 -iL targets.txt -oA nmap_deep_scan
echo "[+] Phase 5: Feedback Loop Extraction"
# Extract domains from SSL certs discovered in Nmap XML output
grep -h "subjectAltName" nmap_deep_scan.xml 2>/dev/null | grep -oE "[a-zA-Z0-9.-]+\.[a-z]{2,}" | sort -u > new_domains_found.txt
echo "[!] Recon Cycle Complete."
echo "[!] Findings saved in: $WORKDIR"
echo "[!] New potential domains discovered: $(wc -l < new_domains_found.txt)"