# Recon Scripts | A simple recon framework for bug bounty hunting

**URL:** <https://onehack.st/t/recon-scripts-a-simple-recon-framework-for-bug-bounty-hunting/158976>\
**Category:** Tools & Scripts\
**Tags:** programming, hacking\
**Created:** [October 16, 2020, 12:34pm UTC](https://onehack.st/t/recon-scripts-a-simple-recon-framework-for-bug-bounty-hunting/158976 "2020-10-16T12:34:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [October 16, 2020, 12:34pm UTC](https://onehack.st/t/recon-scripts-a-simple-recon-framework-for-bug-bounty-hunting/158976/1 "2020-10-16T12:34:07Z")

</div>

```auto
   _________________  ___________________ (_) ___/ /______
  / ___/ _ \/___ / __\/__ \ / ___/___ / ___/ /__ \/ __/___ /
 / / / __/ /__ / /_/ / / / / (__) /__/ / / / /_/ / /_(__ ) 
/_/ \ ___/\___ /\ ____/_/ /_/ /____ /\ ___/_/ /_/ .___ /\ __/____ /  
                                              /_/                

```

[![v0.2.3](https://camo.githubusercontent.com/756a4c874eea162a191d84056cf7a225a6972a03/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e322e332d627269676874677265656e3f7374796c653d666c6174)](https://camo.githubusercontent.com/756a4c874eea162a191d84056cf7a225a6972a03/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e322e332d627269676874677265656e3f7374796c653d666c6174)

[![asciicast](https://camo.githubusercontent.com/1f8bf5f4167a7666f7824e260c20cda95700c9ba/68747470733a2f2f61736369696e656d612e6f72672f612f514a54446c566252784c4e6873536265354d42714b68454e672e737667)](https://asciinema.org/a/QJTDlVbRxLNhsSbe5MBqKhENg)

# A simple recon framework for bug bounty hunting

- Enumerate subdomains using [Sublist3r](https://github.com/aboul3la/Sublist3r) and [Subdominizer](https://github.com/nsonaniya2010/SubDomainizer)
- Probe subdomains using [httpx](https://github.com/projectdiscovery/httpx)
- Check cloud buckets using [cloud\_enum](https://github.com/initstring/cloud_enum) and [S3Scanner](https://github.com/OWASP/Amass)
- Scan webpages using [nuclei](https://github.com/projectdiscovery/nuclei)
- Take screenshots using [Aquatone](https://github.com/michenriksen/aquatone)
- Asset discovery using [hakrawler](https://github.com/hakluke/hakrawler)
- Scan for XSS from asset discovery using [XSStrike](https://github.com/s0md3v/XSStrike)
- Directory bruteforcing using [ffuf](https://github.com/ffuf/ffuf)
- Notify for new URLs or JS files discovered via Slack

**The idea is to turn this:**

```auto
targets
├── tesla
│ └── domains.txt
└── shopify
    └── domains.txt

```

**into this:**

```auto
targets
├── tesla
│ ├── screenshots/
│ ├── urls.txt
│ ├── js.txt
│ ├── githound.txt
│ ├── cloud_enum.txt
│ ├── webservers.txt
│ ├── domains.txt
│ └── subdomains.txt
├── shopify
│ ├── screenshots/
│ ├── urls.txt
│ ├── js.txt
│ ├── cloud_enum.txt
│ ├── webservers.txt
│ ├── domains.txt
│ └── subdomains.txt
│
.
.

```

- Inspired by [lazyrecon](https://github.com/nahamsec/lazyrecon) by [nahamsec](https://github.com/nahamsec)

- This code is created for personal use. But feel free to try it out

- I’m not very good at bash, please point out any weird quirks that could use some improvements ❤

## Setup

**Bash one-line setup. Installs recon-scripts to $HOME/.recon-scripts**

bash \<(curl -s [https://raw.githubusercontent.com/tedmdelacruz/recon-scripts/master/configure](https://raw.githubusercontent.com/tedmdelacruz/recon-scripts/master/configure))

**Initialize a vars.sh from vars.sh.example**

```auto
cd .recon-scripts
cp vars.sh.example vars.sh
vim vars.sh

```

## Usage:

**Run predefined scans**

cd .recon\_scripts $ scans/sweep.sh # Initial scann of all targets in recon folder $ scans/snipe.sh tesla shopify # Probe and quick scan $ scans/bombard.sh shopify # Comprehensive scan

**Set up crontab**

$ crontab -e 30 21 \* \* \* /home/tedm/.recon-scripts/cron/daily.sh

**Or execute individual functions like so:**

$ enumerate\_subdomains [domain.com](http://domain.com) path/to/targets\_dir/target $ probe\_subdomains path/to/target $ cloud\_bucket\_enum path/to/target $ nuclei\_scan path/to/target $ take\_screenshots path/to/target

## TODO

- Configure API key inclusion to subdomain enumerations
- Monitor interesting files and web pages for changes
- Show GitHub dorking links
- Setup port scanning using `dnmasscan`, `masscan`, and `nmap`
- Support multithreading
- Add script for scaffolding directories
- Add reporting

## GitHub:

[https://github.com/tedmdelacruz/recon-scripts](https://github.com/tedmdelacruz/recon-scripts)