First hour on a new program
Do this before you fire nuclei. Most wasted hunts skip the paper.
Tags: recon, intake, scope
Checklist
- Read scope twice: In-scope hosts, wildcards, mobile, APIs, excluded classes, rate limits, safe-harbour, and the out-of-scope list.
- Save the program snapshot: Copy the scope text locally. Programs change. Your report will be judged against what was in scope when you tested.
- Map identities: How do users sign up, log in, reset, SSO, and get roles? How many accounts can you create? Tenant vs user vs admin.
- Map the apps: www, app, api, auth, admin, docs, status, CDN, mobile API, GraphQL, WS. One host per sticky note.
- Passive recon first: subfinder/amass/waymore/gau. No brute, no nuclei spray, no login spray.
- JS before scanners: Pull bundles, maps, and routes. Hidden endpoints beat directory lists.
- Pick a thesis: One chain you actually believe (ATO via reset, IDOR on export, SSRF on unfurl). Hunt that for an hour before spraying.
- Set the canary: OAST payload ready (interactsh / polygrid). Do not hit cloud metadata until a canary proves the fetch.