Building a Bug Bounty Recon Pipeline: subfinder → httpx → Live Targets

Recon is where most bug bounty results are won or lost. Before you test a single payload, you need to know what actually exists: which subdomains are live, what technology they run, and which ones are worth your time. This guide walks through a clean, repeatable recon pipeline — subfinder → httpx → categorize — that turns a bare wildcard scope like *.example.com into a prioritized list of live targets. It’s the workflow serious hunters run on every new program.

The mindset: enumerate wide, then narrow ruthlessly

The goal of recon isn’t to collect the biggest list of subdomains — it’s to find the overlooked surface. Forgotten staging hosts, an old admin panel, a one-off marketing microsite, an internal tool accidentally exposed. Those are where bugs hide, because nobody has hardened them. So you enumerate broadly, then filter down to what’s live and interesting.

Step 1 — Enumerate subdomains with subfinder

subfinder is a passive subdomain discovery tool from ProjectDiscovery. Passive means it queries public sources (certificate transparency logs, DNS aggregators, search engines) rather than brute-forcing, so it’s fast and quiet.

subfinder -d example.com -all -o subs.txt

The -all flag uses every available source. For better results, add free API keys (Shodan, VirusTotal, SecurityTrails, Censys) to ~/.config/subfinder/provider-config.yaml — passive sources are only as good as the feeds behind them, and keyed sources return far more.

Want to also catch subdomains that passive sources miss? Layer in certificate transparency directly and DNS brute-forcing with a good wordlist, then merge and de-duplicate everything into one file. More sources, sorted unique, is always better here.

Step 2 — Find what’s actually alive with httpx

A list of subdomains is not a list of targets. Most will be dead, parked, or internal-only. httpx probes each one and tells you which respond over HTTP/HTTPS, along with useful metadata:

cat subs.txt | httpx -silent -status-code -title -tech-detect -web-server -content-length -o live.txt

Now you have live hosts annotated with their status code, page title, detected technology (via Wappalyzer fingerprints), and server header. That metadata is the whole point — it’s how you decide what to look at first.

Step 3 — Categorize and prioritize

This is the step beginners skip and pros obsess over. Sort your live hosts by what they are, not alphabetically:

• Interesting titles — grep for admin, dashboard, internal, staging, dev, test, portal, jenkins, grafana, swagger. These are the hosts nobody meant to leave exposed.
• Status codes — 200 is obvious, but don’t ignore 401/403 (something is there and gated — an auth-bypass candidate) or 500 (a broken app leaking stack traces).
• Technology — group by stack. A cluster of hosts running the same framework means one bug can repeat across all of them.
• Non-standard ports — re-run httpx with -ports 80,443,8080,8443,3000,8000,9000 to catch apps hiding off the default ports.

A quick way to surface the anomalies:

grep -iE 'admin|staging|dev|internal|swagger|jenkins|grafana' live.txt

Step 4 — Screenshot everything

You cannot eyeball 300 hosts by hand. A tool like gowitness or aquatone captures a screenshot of every live host so you can scan the whole scope visually in minutes. Login panels, default installer pages, and error screens jump out instantly this way — it’s one of the highest-value-per-minute steps in recon.

Putting it together

subfinder -d example.com -all -silent 
  | httpx -silent -status-code -title -tech-detect -o live.txt

gowitness scan file -f <(awk '{print $1}' live.txt)

That's the core loop. From a single root domain you now have a screenshotted, annotated, prioritized inventory of the live attack surface — and you've spent zero time on hosts that don't exist.

Where recon turns into findings

Recon is only the map. Once you have your prioritized list, the work is manual: pull the JavaScript from each interesting host and read it for API endpoints and secrets, run a directory/parameter fuzz against the promising ones, and probe every 401/403 with an auth-bypass matrix. The hunters who win aren't the ones with the biggest subdomain list — they're the ones who process every host on it. Enumerate wide, then be relentless about looking at what you found.

---

Only ever run these tools against targets you are explicitly authorized to test — an active bug bounty scope or your own systems. Recon of out-of-scope assets can violate program rules and the law.