The 7 recon tools every bug hunter uses

Subfinder, httpx, Katana, Nuclei... we build a full bug bounty recon workflow with free tools.

In bug bounty, whoever does the best recon finds the most. Here is a basic workflow with free tools you can chain in the terminal.

1. Subdomains: subfinder + crt.sh

subfinder -d target.com -all -o subs.txt collects subdomains from dozens of passive sources. Complement it with crt.sh to see issued certificates.

Keep only the subdomains that actually resolve: dnsx -l subs.txt -o resolved.txt.

httpx -l resolved.txt -title -tech-detect -status-code tells you what answers over HTTP and which technologies it runs.

Katana walks through applications, JavaScript included, and extracts endpoints you would not see at first glance.

Old URLs stored in web archives often reveal forgotten endpoints and interesting parameters.

Discover hidden parameters on the most promising endpoints.

With thousands of community-maintained templates, Nuclei detects known CVEs and misconfigurations in minutes.

Important: only run these tools against targets in scope of a bug bounty programme or with written authorisation.