Reindeer Software — Build. Ship. Scale.

Why Recon Matters

In bug bounty hunting, the difference between finding critical vulnerabilities and coming up empty often comes down to one thing: reconnaissance. The deeper your recon, the more attack surface you uncover. Here's a methodology that works.

Phase 1: Subdomain Discovery

Most programs disclose only a handful of subdomains. The real attack surface is always larger.

Techniques That Work

Certificate transparency logs — every SSL cert issued for a domain is public record. Scan these to find subdomains the company didn't tell you about.
Search engine dorking — specific queries on search engines can reveal hidden subdomains and endpoints.
DNS brute forcing — common subdomain names tested against the target's DNS servers.

What You're Looking For

Staging/UAT environments — usually less secured than production
Internal dashboards — accidentally exposed admin panels
API subdomains — direct API access without the web app layer
Regional variants — au., eu., sg. subdomains with different configs

Phase 2: Endpoint Enumeration

Once you have subdomains, probe them for accessible endpoints.

Common High-Value Endpoints

/actuator — Spring Boot actuator endpoints (health, env, metrics)
/api or /v1 — Open API documentation
/.env — environment variable leaks (rare but critical)
/robots.txt — sometimes reveals hidden paths
/sitemap.xml — full URL map of the site

What to Check

Authentication bypass — is the endpoint accessible without login?
Information disclosure — does it leak internal IPs, stack traces, configs?
CORS headers — Access-Control-Allow-Origin: * with credentials?

Phase 3: Configuration Review

Many bugs aren't in the application logic — they're in the configuration.

Common Findings

CORS misconfiguration — dynamic origin reflection with credentials enabled. This allows data exfiltration from authenticated users.
Missing security headers — no CSP, HSTS, or X-Frame-Options.
Verbose error pages — stack traces revealing internal paths and versions.
Default credentials — administrative panels using default passwords.

The Methodology in Practice

A typical recon session looks like this:

Start with the disclosed scope (usually 3-5 subdomains)
Run passive recon to find 10x more subdomains
Probe every endpoint on every subdomain
Check for config issues before diving into application logic
Prioritize: authentication bypass > data leak > config issue > logic bug

Key Takeaway

The best bug bounty hunters don't find bugs that others missed — they find attack surface that others didn't look at. Invest in recon, and the vulnerabilities will follow.

"How to Approach Bug Bounty Recon Like a Pro"