How to: Recon and Content Discovery

A recon how-to for bug hunters: recursively brute-force subdomains to map dev and corp environments, mine GitHub for internal hosts and keys, and expand the attack surface before hunting bugs.