PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Recon series recap: The ultimate guide to Bug Bounty reconnaissance and footprinting

yeswehack.com | blog | #bug-bounty | #nmap | #shodan | #recon | #subdomain-enumeration | #http-fingerprinting | #google-dorking
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recap of a six-part recon series covering hidden endpoints, subdomain enumeration, HTTP fingerprinting, hidden parameters and Google dorking, with tools like Nmap, Shodan and the Wayback Machine.
Published
Collected

Related coverage

blog · yeswehack.com
Recon series #4: Port scanning – uncovering attack vectors by revealing open ports and hidden services
Recon series #4 on port scanning: passive scans via Shodan and Censys, active TCP/UDP techniques, banner grabbing, firewall evasion, and tools including Nmap, Masscan, Naabu and httpx.
blog · yeswehack.com
Recon Series #2: Subdomain enumeration – expand attack surfaces with active, passive techniques
Recon series #2 on subdomain enumeration: passive techniques via Censys, Shodan and SecurityTrails, Google dorking, DNS brute-forcing and vhost fuzzing, demonstrated on the ATG bug bounty program.
blog · yeswehack.com
Recon series #5: A hacker’s guide to Google dorking
Beginner-friendly guide to Google dorking: core operators such as site:, inurl: and filetype:, plus hands-on queries for subdomain discovery, hidden files, login portals and exposed credentials.
blog · yeswehack.com
Recon series #3: HTTP fingerprinting – sleuthing for a web application’s hidden vulnerabilities
Recon series #3 on HTTP fingerprinting: analysing response headers, banner grabbing, malformed requests, default file structures and cookie parameters to map technologies and hidden weaknesses.
blog · netlas.io
Top 15 OSINT Tools for Expert Intelligence Gathering
Curated list of 15 free OSINT tools—theHarvester, SecurityTrails, BGPView, Mitaka, Shodan, SpiderFoot, Maltego, Nmap and more—with use cases, legal notes and market context.
blog · yeswehack.com
‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter
YesWeHack interviews Issam Rabhi, its all-time #1 bug bounty hunter, on his path from reverse engineering to top rankings, his recon-first automation methodology, favourite vulnerability types, notable finds, and advice for aspiring hackers.
Back