Recon Is Everything — Where Real Bugs Actually Hide

Hey hackers! Nitin back again 👋

Want to know the biggest secret in bug bounty? It's boring. Ready? Here it is: recon wins.

Not fancy exploits. Not 0-days. Just good old recon — mapping out everything a company owns before you even try to break anything. The hunters who win are the ones who looked where nobody else bothered to look.

What Is Recon, Really?

Think of it like a burglar casing a building. Before touching anything, they walk around the whole block. How many doors? Which windows are open? Is there a forgotten back entrance nobody locked?

That's recon. You're building a map of the target's entire attack surface so you can find the soft, forgotten spot. And trust me, there's ALWAYS a forgotten spot.

The Recon Mindset (This Changed My Game)

Old thinking: "Let me dump 10,000 subdomains into a file." 😪

New thinking: "Let me find the WEIRD stuff. The new feature. The forgotten old server. The endpoint that behaves differently when I log in."

A single complex feature — like a checkout flow or a file uploader — is worth more than 100 boring landing pages. Go where the action is.

My Actual Recon Flow

Here's roughly how I attack a new target:

1. Find all the domains and subdomains (next post is all about this)
2. See which ones are alive — a tool like httpx tells me which respond
3. Pull old URLs from archives using gau and waybackurls — you'd be SHOCKED what old URLs reveal
4. Screenshot everything with gowitness or aquatone so I can eyeball interesting pages fast
5. Hunt for the juicy stuff — login pages, admin panels, API endpoints, password resets, anything that handles money or data

The Bug Hiding Spots

When I do recon, I'm specifically looking for:

• Old, forgotten subdomains (dev.target.com, staging.target.com) — these are RARELY patched
• API endpoints — the backend that the app talks to, often less protected than the front
• New features — freshly shipped code = freshly shipped bugs
• Anything labeled "beta" or "test" — basically a neon sign saying "under-secured"

One Real Lesson

On one program I spent two whole days just on recon. No hacking. People thought I was wasting time. But on day three I found a forgotten staging subdomain with debug mode left ON — and it leaked internal data. That's a critical, just from being patient with recon.

Recon isn't the exciting part. But it's the part that pays. Be the person willing to look where others got bored.

Next up: subdomain enumeration, hands-on. That's where the doors are.

Happy hunting! 🔍