7 Recon Tricks Made Me Earn $$$ Bounty

Find your first bug by performing recon in a common but in an unusual way

Hi geeks, it4chis3c (Twitter) came-up with another bounty earning write-up in the Bug Bounty Hunting Series:

Bug Bounty Hunting Series

Credit: Gemini | Imagen 3

Find subdomains others miss by brute-forcing permutations.
Tools: Amass, altdns, httpx

# Step 1: Passive enumeration with Amass  
amass enum -passive -d target.com -o subs.txt  # Step 2: Generate permutations (e.g., dev-api → api-dev, beta-api)  
altdns -i subs.txt -o permutations.txt -w ~/bugbounty/wordlists/altdns_words.txt  
# Step 3: Resolve live subdomains  
httpx -l permutations.txt -silent -o live_subs.txt

Bug found: Found dev-admin.target.com — Unauthenticated dashboard

Extract URLs with vulnerable parameters from archived data.
Tools: waybackurls…