Post cover image

October 25, 2026

I Automated My Entire Bug Bounty Recon :One Script, Start to Finish

Stop running 15 tools manually. Here’s the exact pipeline I use to go from “a company name” to “a list of live, testable targets” in one…

By Monika

5 min read

Stop running 15 tools manually. Here's the exact pipeline I use to go from "a company name" to "a list of live, testable targets" in one run.

Over this series, we've covered JS file recon, IDOR, Business Logic bugs, Subdomain Takeovers, Rate Limiting, and File Upload vulnerabilities. Every single one of those techniques depends on the same first step: good recon. If your recon is weak, you'll miss targets before you even get to test them.

Most hunters run tools one at a time — 'subfinder', then 'httpx', then 'nuclei', copy-pasting output between each. It works, but it's slow, error-prone, and you end up repeating the same manual steps on every new target.

So I built a single recon pipeline that chains everything together subdomain discovery, live host detection, port scanning, JS file extraction, endpoint discovery, vulnerability scanning, and screenshotting — all from one script. This article walks through every stage and gives you the full toolchain to copy.

The recon pipeline at a glance

Target domain
      │
      ▼
[1] Subdomain Enumeration  (subfinder, assetfinder, amass)
      │
      ▼
[2] Live Host Detection    (httpx)
      │
      ▼
[3] Port Scanning          (naabu)
      │
      ▼
[4] Screenshotting         (gowitness)
      │
      ▼
[5] URL & JS Discovery     (katana, waybackurls, gau)
      │
      ▼
[6] JS Secret/Endpoint Extraction  (SecretFinder, LinkFinder)
      │
      ▼
[7] Parameter Discovery    (arjun, paramspider)
      │
      ▼
[8] Vulnerability Scanning (nuclei)
      │
      ▼
[9] Subdomain Takeover Check (nuclei templates)
      │
      ▼
Organized output, ready to manually test

Each stage feeds the next one. Let's go through them in order.

Step 1: Subdomain enumeration

We start wide — combining three tools gives far better coverage than any single one alone:

subfinder -d $1 -all -silent -o subs_subfinder.txt
assetfinder --subs-only $1 > subs_assetfinder.txt
amass enum -passive -d $1 -o subs_amass.txt

cat subs_subfinder.txt subs_assetfinder.txt subs_amass.txt | sort -u > all_subs.txt

Step 2: Live host detection

Not every subdomain found is actually live. Filter down to what's actually reachable, and grab useful metadata at the same time:

cat all_subs.txt | httpx -silent -title -tech-detect -status-code -o live_hosts.txt

This single command tells you which hosts are alive, what technology they run useful for picking the right attack techniques later, and their page titles handy for spotting admin panels, staging environments, and dev tools at a glance.

Step 3: Port scanning

Web isn't the only attack surface. Run a fast port scan across all live hosts to catch exposed services beyond 80/443:

cat all_subs.txt | naabu -silent -top-ports 1000 -o open_ports.txt

Watch for unusual open ports — database ports (3306, 5432, 27017), admin interfaces (8080, 8443, 9090), or anything that shouldn't be internet-facing.

Step 4: Screenshotting everything

When you're dealing with hundreds of subdomains, manually opening each one in a browser isn't practical. gowitness takes a screenshot of every live host so you can visually scan for interesting targets — login pages, outdated software banners, default install pages, staging environments:

gowitness file -f live_hosts.txt -P screenshots/ --no-http

Open the screenshots/ folder and scroll — this is often the fastest way to spot a juicy target buried in a list of 500 subdomains.

Step 5: URL and JS file discovery

Now we go deep on each live host, pulling historical and current URLs plus every JS file:

cat live_hosts.txt | while read url; do
  katana -u "$url" -jc -silent >> all_urls.txt
done

waybackurls $1 >> all_urls.txt
cat all_subs.txt | gau >> all_urls.txt

sort -u all_urls.txt -o all_urls.txt
grep "\.js$" all_urls.txt > js_files.txt

Step 6: Secrets and endpoints from JS files

This is the step we covered in detail in [the first article of this series] — now folded into the pipeline:

cat js_files.txt | httpx -silent -mc 200 -o live_js.txt
python3 SecretFinder.py -i live_js.txt -o cli >> secrets_found.txt

for url in $(cat live_js.txt); do
  python3 linkfinder.py -i "$url" -o cli >> endpoints.txt
done

sort -u endpoints.txt -o endpoints.txt

Step 7: Parameter discovery

Hidden GET/POST parameters are a common source of IDOR, SSRF, and injection bugs. arjun brute-forces likely parameter names against discovered endpoints:

cat endpoints.txt | while read ep; do
  arjun -u "$ep" -o params_found.txt
done

Step 8: Automated vulnerability scanning

'nuclei' runs thousands of community-maintained templates covering CVEs, misconfigurations, exposed panels, default credentials, and more against every live host in one pass:

nuclei -l live_hosts.txt -t cves/ -t exposures/ -t misconfiguration/ -severity medium,high,critical -o nuclei_results.txt

Step 9: Subdomain takeover check

Covered in detail in the subdomain takeover article — now automated as part of the full run:

cat all_subs.txt | dnsx -silent -cname -resp -o resolved_subs.txt
nuclei -l resolved_subs.txt -t subdomain-takeover/ -o takeover_results.txt

Putting it all together: the full script

Here's everything chained into a single script. Save it as 'recon.sh':

#!/bin/bash
# Usage: bash recon.sh target.com

domain=$1
mkdir -p recon_$domain && cd recon_$domain

echo "[*] Subdomain enumeration..."
subfinder -d $domain -all -silent -o subs_subfinder.txt
assetfinder --subs-only $domain > subs_assetfinder.txt
amass enum -passive -d $domain -o subs_amass.txt
cat subs_subfinder.txt subs_assetfinder.txt subs_amass.txt | sort -u > all_subs.txt

echo "[*] Checking live hosts..."
cat all_subs.txt | httpx -silent -title -tech-detect -status-code -o live_hosts.txt

echo "[*] Port scanning..."
cat all_subs.txt | naabu -silent -top-ports 1000 -o open_ports.txt

echo "[*] Taking screenshots..."
gowitness file -f live_hosts.txt -P screenshots/ --no-http

echo "[*] Crawling URLs and JS files..."
cat live_hosts.txt | while read url; do katana -u "$url" -jc -silent >> all_urls.txt; done
waybackurls $domain >> all_urls.txt
cat all_subs.txt | gau >> all_urls.txt
sort -u all_urls.txt -o all_urls.txt
grep "\.js$" all_urls.txt > js_files.txt

echo "[*] Extracting secrets and endpoints from JS..."
cat js_files.txt | httpx -silent -mc 200 -o live_js.txt
python3 ../SecretFinder.py -i live_js.txt -o cli >> secrets_found.txt
for url in $(cat live_js.txt); do python3 ../linkfinder.py -i "$url" -o cli >> endpoints.txt; done
sort -u endpoints.txt -o endpoints.txt

echo "[*] Running nuclei scans..."
nuclei -l live_hosts.txt -t cves/ -t exposures/ -t misconfiguration/ -severity medium,high,critical -o nuclei_results.txt

echo "[*] Checking for subdomain takeovers..."
cat all_subs.txt | dnsx -silent -cname -resp -o resolved_subs.txt
nuclei -l resolved_subs.txt -t subdomain-takeover/ -o takeover_results.txt

echo "[+] Done! Results saved in recon_$domain/"

Run it:

bash recon.sh target.com

Within one run, you get subdomains, live hosts, open ports, screenshots, URLs, JS secrets, endpoints, nuclei findings, and takeover checks — all organized in one folder, ready for manual deep-dive testing using the techniques from the rest of this series.

Making this even faster: run it in the background

For large scopes, this script can take a while. Run it in the background and move on to manual testing on hosts you already have:

nohup bash recon.sh target.com > recon.log 2>&1 &

Check progress anytime with:

tail -f recon.log

A few practical tips

  • Rate-limit yourself. Running this against a target with a lot of subdomains can generate serious traffic. Check the program's rules on scan rate before running it full-speed.
  • Re-run periodically. Companies add new subdomains, deploy new services, and forget old ones constantly. Running this pipeline weekly on your favorite targets often turns up fresh attack surface that wasn't there last time.
  • Diff your results. Save each run's all_subs.txt with a date, and diff it against the previous run to instantly spot new subdomains — these are often the least-tested, most vulnerable ones.
diff old_all_subs.txt all_subs.txt | grep ">"

Final Thoughts

Recon is the foundation everything else in this series builds on — you can't find IDOR, business logic flaws, or upload vulnerabilities on targets you never discovered in the first place. Automating this pipeline doesn't replace manual testing skill, but it does mean you spend your time actually hunting for bugs instead of babysitting tools one at a time.

Save this script, tweak it to your workflow, and run it as the first step on every new target.

If this guide helped you, consider buying me a coffee ☕ — it keeps me motivated to dig up and write more bugs like this. Buy me a coffee

Monika Hi, I'm Monika ✨I break down real-world bug bounty reports into simple, practical write-ups.If my articles help you…