recon-hunter

# RECON-HUNTER — Full Recon + Bug Discovery Pipeline **One rule: impact first. Only report what an attacker can abuse RIGHT NOW.** Kill theoretical findings before they reach the report. ``` [ TARGET ROOT DOMAIN / IP ] │ ┌──────────────────────────────────────────┴──────────────────────────────────────────┐ ▼ ▼ [ PHASE 01-04: PERIMETER & HOST MAPPING ] [ PHASE 05-08: URLS, CRAWL & JAVASCRIPT ] • Phase 01: Passive Subdomain Enumeration (zero-touch) • Phase 05: Historical URL Collection & Juicy Probing • Phase 02: DNS Resolution & httpx Fingerprint Pass • Phase 06: Active Multi-Engine Crawl (Katana/GoSpider) • Phase 03: Non-CDN Port Scanning & Service Probing • Phase 07: Target-Derived Directory & Endpoint Fuzzing • Phase 04: Subdomain Takeover & CNAME Dangling Audit • Phase 08: JavaScript Analysis, SSR State & Secrets │ │ └──────────────────────────────────────────┬──────────────────────────────────────────┘ ▼ ┌──────────────────────────────────────────┴──────────────────────────────────────────┐ ▼ ▼ [ PHASE 09-12: VULNERABILITY & EXPOSURE ] [ PHASE 13-16: PROTOCOLS, SUPPLY & TRIAGE ] • Phase 09: Nuclei Automated Vulnerability Scan • Phase 13: SSRF Entry Point Parameter Mining & OOB • Phase 10: Cloud Storage & Firebase Bucket Permutation • Phase 14: GraphQL Discovery & Schema Introspection • Phase 11: Source Code, VCS & 21 Sensitive Configs • Phase 15: Org Secret Hunt & Dependency Confusion • Phase 12: CORS Origin Reflection & Credential Audit • Phase 16: Headless Screenshotting & Visual Triage │ │ └──────────────────────────────────────────┬──────────────────────────────────────────┘ ▼ [ CONSOLIDATED FINDINGS TRIAGE ] • CRITICAL / HIGH / MEDIUM / SSRF • 60-Second Copyable PoC Curl Standard • 16-Phase Completed Coverage Ledger ``` --- ## Master Skill Delegation Architecture While `recon-hunter` coordinates the rapid 16-phase pipeline end-to-end, each phase maps directly to our specialized framework skills: | Phase | Title | Primary Engine / Commands | Specialized Skill Reference | |---|---|---|---| | **Phase 01** | Passive Subdomain Enum | `crt.sh`, `subfinder`, `amass`, `chaos`, `cero`, `github-subdomains` | [subdomainenum](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/subdomainenum/SKILL.md) | | **Phase 02** | DNS Resolution & Tech Detect | `dnsx`, `httpx -title -tech-detect -cdn -follow-redirects` | [techfingerprint](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/techfingerprint/SKILL.md) | | **Phase 03** | Port Scan & Services | `naabu` (non-CDN), `nmap -sV`, unauth service verification | [techfingerprint](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/techfingerprint/SKILL.md) | | **Phase 04** | Subdomain Takeover | `nuclei -t takeovers/`, `subjack`, 11 signature grep loop | [subdomainenum](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/subdomainenum/SKILL.md) | | **Phase 05** | Historical URLs & Juicy Files | `waybackurls`, `gau`, `waymore`, juicy extension `httpx -mc 200` | [contentdiscovery](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/contentdiscovery/SKILL.md) | | **Phase 06** | Active Web Crawl | `katana -jc -jsl -d 5 -kf all -aff`, `gospider`, `hakrawler` | [linkparamdiscovery](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/linkparamdiscovery/SKILL.md) | | **Phase 07** | Directory & Endpoint Fuzzing | Target-derived wordlist (`unfurl`), `ffuf -ac`, API fuzzing | [contentdiscovery](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/contentdiscovery/SKILL.md) | | **Phase 08** | JS Analysis & Secret Extraction| `js-beautify`, `trufflehog`, `gitleaks`, live token validation | [jsrecon](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/jsrecon/SKILL.md) | | **Phase 09** | Nuclei Automated Vulnerability| `nuclei -severity critical,high,medium`, priority exposures | [contentdiscovery](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/contentdiscovery/SKILL.md) | | **Phase 10** | Cloud Storage & Buckets | Multi-cloud S3/GCS/Azure permutations, Firebase RTDB shallow | [cloud-supplychain](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/cloud-supplychain/SKILL.md) | | **Phase 11** | Source Code & Config Exposure | `.git/config`, `.env`, Spring actuators, 21 sensitive paths | [contentdiscovery](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/contentdiscovery/SKILL.md) | | **Phase 12** | CORS Origin Reflection | Arbitrary origin, `Origin: null`, `Allow-Credentials: true` | [api-security](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/api-security/SKILL.md) | | **Phase 13** | SSRF Entry Point Discovery | Regex parameter filtering, Out-Of-Band interactsh verification | [ssrf-audit](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/ssrf-audit/SKILL.md) | | **Phase 14** | GraphQL Discovery & Schema | `{__typename}` probe, full schema introspection dump | [api-security](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/api-security/SKILL.md) | | **Phase 15** | Org Secrets & Supply Chain | `trufflehog github --org`, npm package registry 404 audit | [cloud-supplychain](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/cloud-supplychain/SKILL.md) | | **Phase 16** | Screenshot & Visual Triage | `gowitness file -f subs/live_http.txt --resolution 1280x800` | [techfingerprint](file:///c:/Users/rautp/Documents/BBskill/.agents/skills/techfingerprint/SKILL.md) | --- ## PHASE 0 — Setup ```bash T="<target_apex_domain>" # Set apex domain OUT="artifacts/recon_${T}" mkdir -p "$OUT"/{subs,urls,js,ports,screenshots,findings,cloud} ``` --- ## PHASE 1 — Passive Subdomain Enumeration (zero-touch) Goal: maximum breadth before touching target infrastructure. ```bash # 1. Certificate transparency curl -s "https://crt.sh/?q=%25.$T&output=json" \ | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u >> "$OUT/subs/raw.txt" # 2. subfinder (all sources) subfinder -d "$T" -all -silent >> "$OUT/subs/raw.txt" # 3. amass passive amass enum -passive -d "$T" -o "$OUT/subs/amass.txt" 2>/dev/null cat "$OUT/subs/amass.txt" >> "$OUT/subs/raw.txt" # 4. chaos (ProjectDiscovery dataset) chaos -d "$T" -silent 2>/dev/null >> "$OUT/subs/raw.txt" # 5. github-subdomains (requires GITHUB_TOKEN env) github-subdomains -d "$T" -t "$GITHUB_TOKEN" -o "$OUT/subs/github.txt" 2>/dev/null cat "$OUT/subs/github.txt" >> "$OUT/subs/raw.txt" # 6. cero (TLS SAN scraping) cero "$T" 2>/dev/null >> "$OUT/subs/raw.txt" # Deduplicate sort -u "$OUT/subs/raw.txt" -o "$OUT/subs/all.txt" wc -l "$OUT/subs/all.txt" ``` **Bug signals during enumeration:** - Subdomains matching `*.s3.amazonaws.com`, `*.pages.dev`, `*.netlify.app`, `*.github.io`, `*.azurewebsites.net`, `*.vercel.app` -> *queue for takeover check (Phase 4)* - `dev-`, `staging-`, `internal-`, `admin-`, `api-` prefixes -> *high-value targets, prioritize* --- ## PHASE 2 — DNS Resolution + Live Host Discovery ```bash # Resolve all subs to live IPs dnsx -l "$OUT/subs/all.txt" -resp -a -cname -silent -o "$OUT/subs/resolved.txt" cat "$OUT/subs/resolved.txt" | awk '{print $1}' > "$OUT/subs/live_hosts.txt" # httpx — full fingerprint pass httpx -l "$OUT/subs/live_hosts.txt" \ -title -tech-detect -status-code -content-length \ -ip -cdn -cname -follow-redirects \ -mc 200,201,204,301,302,307,401,403,404,500 \ -o "$OUT/subs/httpx.json" -j -silent # Extract live HTTP hosts cat "$OUT/subs/httpx.json" | jq -r '.url' > "$OUT/subs/live_http.txt" wc -l "$OUT/subs/live_http.txt" ``` **Bug signals:** - `401`/`403` on `admin.*`, `internal.*`, `api.*` -> *queue for 403 bypass* - `500` responses -> *server errors, potential injection surface* - CDN=false + IP exposed -> *origin IP bypass candidate* - `tech-detect` shows old versions -> *CVE check queue* --- ## PHASE 3 — Port Scanning + Service Discovery Run only against non-CDN IPs (CDN scanning is wasteful and often out-of-scope). ```bash # Extract non-CDN IPs from httpx output cat "$OUT/subs/httpx.json" | jq -r 'select(.cdn==false) | .host' | sort -u > "$OUT/ports/ips.txt" # Fast port scan — top 1000 + common web/service ports naabu -l "$OUT/ports/ips.txt" -top-ports 1000 \ -p 80,443,8080,8443,8888,9000,9200,9300,5601,3000,3001,4000,5000,6379,27017,5432,3306,2375,2376 \ -o "$OUT/ports/open.txt" -silent # Service banner + version (nmap on open ports only) nmap -iL "$OUT/ports/open.txt" -sV --open -T4 \ --script=banner,http-title,http-server-header \ -oN "$OUT/ports/nmap.txt" -oX "$OUT/ports/nmap.xml" 2>/dev/null ``` **High-value service signals -> immediate bug checks:** | Service | Port | Unauthenticated Impact Probe Command | |---|---|---| | **Elasticsearch** | 9200/9300 | `curl -sk http://IP:9200/_cat/indices?v` | | **Kibana** | 5601 | `curl -sk http://IP:5601/api/status` | | **Redis** | 6379 | `redis-cli -h IP ping` | | **MongoDB** | 27017 | `mongo --host IP --eval "db.adminCommand('listDatabases')"` | | **Docker API** | 2375/2376 | `curl -sk http://IP:2375/v1.41/containers/json` | | **Kubernetes** | 6443/10250 | `curl -sk https://IP:10250/pods -k` | | **Spring Actuator** | 8080/8443 | `curl -sk http://HOST/actuator` | | **Prometheus** | 9090 | `curl -sk http://HOST:9090/metrics` | | **Grafana** | 3000 | Default `admin:admin` login | | **Jenkins** | 8080 | `curl -sk http://HOST:8080/api/json` | --- ## PHASE 4 — Subdomain Takeover Check ```bash # 1. nuclei takeover templates against all live hosts nuclei -l "$OUT/subs/live_http.txt" \ -t http/takeovers/ \ -severity medium,high,critical \ -o "$OUT/findings/takeovers.txt" -silent # 2. subjack for CNAME-based takeover subjack -w "$OUT/subs/all.txt" -t 100 -timeout 30 \ -o "$OUT/findings/subjack.txt" -ssl 2>/dev/null # 3. Real-time fingerprint grep loop for host in $(cat "$OUT/subs/live_http.txt"); do body=$(curl -sk --max-time 6 "$host") for sig in "There isn't a GitHub Pages site here" \ "The specified bucket does not exist" \ "NoSuchBucket" \ "Repository not found" \ "Project not found" \ "Fastly error: unknown domain" \ "This shop is currently unavailable" \ "Domain not configured" \ "404 Not Found" \ "You're Almost There" \ "a Netlify site"; do echo "$body" | grep -qi "$sig" && echo "[TAKEOVER?] $host — $sig" | tee -a "$OUT/findings/takeovers.txt" done done ``` --- ## PHASE 5 — Historical URL Collection + Secret Hunting in URLs ```bash # Collect historical URLs — three sources for host in $(cat "$OUT/subs/live_hosts.txt"); do echo "$host" | waybackurls 2>/dev/null >> "$OUT/urls/all.txt" echo "$host" | gau --subs 2>/dev/null >> "$OUT/urls/all.txt" waymore -i "$host" -mode U -oU /tmp/wm.txt 2>/dev/null cat /tmp/wm.txt >> "$OUT/urls/all.txt" done