Recon And Methodology

This is a structured playbook for reconnaissance and vulnerability discovery, covering the full chain from subdomain enumeration through endpoint discovery to actual bug hunting. It walks you through passive and active recon with tools like subfinder, ffuf, and nuclei, then shifts into the mindset piece: how to actually find bugs others miss by going deep instead of wide, testing where filters exist, and understanding what each parameter type implies about server-side behavior. The Zseano methodology section is the strongest part, it's less about running tools and more about developing intuition for where vulnerabilities hide. Use this when you're starting work on a new bug bounty target or need to systematize your recon process instead of just throwing automated scanners at everything.

skills.sh installs: 4.3K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill recon-and-methodology --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Recon and Methodology — Expert Bug Bounty Playbook

AI LOAD INSTRUCTION: Systematic recon and bug-finding methodology from top bug hunters. Covers subdomain enumeration, endpoint discovery, tech fingerprinting, and the hunter's mental model for finding bugs that others miss. Key insight: most high-severity bugs are found through systematic coverage, not just clever payloads.

1. RECON HIERARCHY

Target Selection
└── Scope Definition (in-scope assets)
    └── Asset Discovery (subdomains, IPs, domains)
        └── Tech Fingerprinting (what's running)
            └── Endpoint Discovery (attack surface)
                └── Vulnerability Testing (per vulnerability type)

2. SUBDOMAIN ENUMERATION (CRITICAL FIRST STEP)

Passive (no DNS queries to target)

# Subfinder (aggregates multiple sources):
subfinder -d target.com -o subdomains.txt

# Amass passive:
amass enum -passive -d target.com

# Certsh (certificate transparency):
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# SecurityTrails API, Shodan:
# Web: https://securitytrails.com/list/apex_domain/target.com

SKILL.md on GitHub