🔍 Reconnaissance

1. Subfinder

Passive subdomain discovery querying 40 or more data sources simultaneously. The foundation of every recon workflow. Nothing else comes close for coverage at this stage.

Key flags worth knowing:

  • recursive to enumerate subdomains of discovered subdomains
  • all to use all available sources even slower ones
  • provider-config to point at your API keys config

2. Assetfinder

A lightweight complement to Subfinder. Different sources mean different coverage, and the subdomains one tool misses the other often finds. Run both and merge the output with anew.

assetfinder --subs-only target.com | anew subdomains.txt

3. Amass

The most thorough subdomain enumeration tool available, but slower than Subfinder. I use it on high-value targets where coverage matters more than speed, and in passive mode to avoid generating noise.

amass enum -passive -d target.com -o amass_output.txt

4. Shodan CLI

Internet-wide scan data queryable from the command line. Useful for finding non-standard ports, exposed services, and infrastructure not discoverable through DNS enumeration alone.

shodan search "hostname:target.com" --fields ip_str,port,org

A Shodan API key unlocks the real value. The free tier is enough to start.

🌐 Surface Mapping

5. Httpx

Already covered in the previous post, but it's here because it's genuinely irreplaceable. Takes a subdomain list, returns live hosts with status codes, titles, and technology fingerprints in seconds.

The most useful single flag combination:

cat subdomains.txt | httpx -title -tech-detect -status-code -silent

6. Katana

Katana is a next-generation web crawler. It follows links, extracts JavaScript-rendered endpoints, discovers API paths, and finds content that traditional crawlers miss.

katana -u <https://target.com> -jc -d 3 -silent -o endpoints.txt

The -jc flag enables JavaScript crawling, which is where the interesting endpoints usually hide in modern single-page applications.

7. Waymore

Pulls historical URLs from multiple archive sources: Wayback Machine, Common Crawl, URLScan, and others. Historical endpoints often reveal functionality that was removed from the UI but not from the backend.

waymore -i target.com -mode U -oU wayback_urls.txt

Filtering for interesting patterns in the output:

cat wayback_urls.txt | grep -E "\\.(php|asp|aspx|jsp)\\?" | sort -u
cat wayback_urls.txt | grep -E "(admin|api|internal|backup|config)" | sort -u

🔬 Analysis and Probing

8. Nuclei

Template-based vulnerability scanner covering thousands of CVEs, misconfigurations, and exposure checks. The output quality depends entirely on how you configure it:

  • Always update templates before running
  • Filter to critical, high, medium to reduce noise
  • Exclude dos tags to avoid accidental disruption
  • Verify every finding manually before reporting

9. Ffuf

The fastest web fuzzer available. Used for directory discovery, parameter fuzzing, virtual host discovery, and anything else that involves sending many requests with a wordlist.

# Directory discovery
ffuf -u <https://target.com/FUZZ> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -fc 404

# Parameter fuzzing
ffuf -u "<https://target.com/api/user?FUZZ=test>" -w params_wordlist.txt -fc 400

10. Arjun

Discovers hidden HTTP parameters. Many endpoints accept parameters that aren't documented or visible in the UI. Arjun tests thousands of common parameter names and reports which ones affect the response.

arjun -u <https://target.com/api/endpoint> --stable

Hidden parameters are frequently the entry point for IDOR, injection, and access control findings.

11. Gf (Grep for Patterns)

Tomnomnom's pattern matching tool with predefined patterns for common vulnerability indicators. Pipe URLs or responses through it to surface things worth investigating.

# Find potential SQL injection parameters
cat urls.txt | gf sqli

# Find potential SSRF parameters
cat urls.txt | gf ssrf

# Find redirect parameters
cat urls.txt | gf redirect

Combine with Wayback URLs and endpoint lists for fast triage of large URL sets.

🔐 Web Application Testing

12. Burp Suite

The non-negotiable tool for web application testing. Everything gets proxied through Burp. The interceptor, repeater, intruder, and scanner are all used constantly.

Extensions that earn their place:

  • Autorize: Automatically retests requests with a different user's session to find access control issues
  • Param Miner: Discovers hidden parameters and headers
  • JS Miner: Extracts endpoints and secrets from JavaScript files
  • Logger++: Advanced request and response logging with filtering
  • Hackvertor: Encoding and decoding in the request editor

Community edition is free and sufficient for most work. Pro is worth it for active scanner access and some extensions.

13. SQLMap

Automated SQL injection detection and exploitation. Not for first-pass discovery: for confirming and extracting data from injection points identified manually.

# Test a specific parameter
sqlmap -u "<https://target.com/search?q=test>" -p q --batch --level 2

# With a captured request file from Burp
sqlmap -r request.txt --batch --level 2 --risk 2

14. Dalfox

Automated XSS scanner specifically designed for bug bounty work. Faster and more accurate than generic scanners for reflected and stored XSS.

cat urls.txt | dalfox pipe -o xss_findings.txt

☁️ Specialized and Situational

15. CloudBrute

Discovers cloud storage buckets and resources across AWS, GCP, and Azure. Exposed buckets with sensitive data are a consistent source of high-severity findings.

cloudbrute -d target.com -k target -m storage

16. GitLeaks

Scans repositories, commit history, and files for secrets: API keys, tokens, passwords, and private keys. Useful when you have access to source code, find an exposed git directory, or are reviewing JavaScript bundles.

gitleaks detect --source /path/to/repo -v

17. Trufflehog

Similar to GitLeaks but with a focus on verified secrets. It attempts to validate discovered credentials against real APIs before reporting, which reduces false positives significantly.

trufflehog github --repo <https://github.com/target/repo>

18. Interactsh

ProjectDiscovery's out-of-band interaction tool. Generates unique URLs and DNS names you can use in tests. When a target makes a request to your Interactsh URL, you get an alert confirming blind SSRF, blind XSS, blind command injection, and similar vulnerabilities that don't return visible output.

# Start a client
interactsh-client

# Use the generated URL in your tests
# Any interaction gets logged and alerted

📋 Organization and Workflow

19. Anew

Tiny tool with outsized impact. Takes stdin, outputs only lines not seen before, and appends them to a file. This makes it the key to continuous monitoring: run your recon pipeline repeatedly and only get alerted to genuinely new results.

# Only outputs and saves subdomains not seen in previous runs
subfinder -d target.com -silent | anew known_subdomains.txt

20. Notify

Sends tool output to Discord, Slack, Telegram, or other notification channels. When combined with Anew and a scheduled cron job, it pushes new findings to your phone without you having to check manually.

# Send Nuclei findings to Discord
cat nuclei_results.txt | notify
# Or inline in a pipeline
nuclei -l urls.txt -severity critical,high -silent | notify

📦 Wordlists: The Underrated Resource

No tool section is complete without wordlists. The quality of your fuzzing and discovery depends directly on wordlist quality.

SecLists is the standard:

git clone <https://github.com/danielmiessler/SecLists.git> /usr/share/seclists

The paths worth knowing inside SecLists:

  • Discovery/Web-Content/ for directory and file fuzzing
  • Discovery/DNS/ for subdomain brute forcing
  • Fuzzing/ for injection and parameter testing
  • Passwords/ for credential testing

🗂️ How the Workflow Actually Looks

In practice, these tools chain together. A typical session:

  • Subfinder and Assetfinder run simultaneously, output merged with Anew
  • Httpx maps the live surface and identifies interesting targets
  • Katana and Waymore build a URL inventory
  • Gf filters the URL inventory for vulnerability indicators
  • Burp Suite for manual investigation of anything interesting
  • Nuclei against the full live host list while manual testing happens in parallel
  • Interactsh URLs embedded in tests for blind vulnerability confirmation
  • Notify pushes anything new to Discord overnight

The tools aren't magic. The workflow is what produces results. Each tool does one job well and hands off to the next. 🎯