Testing playbook · advanced

Scaling: Automation & Monitoring

Move from one-off scans to continuous coverage that pings you when a target's attack surface changes.

automationmonitoringpipelines

Stable IDplaybook:mass-hunting-automationLast updated2026-08-20Last verifiedLegacy review pendingProvenanceCurated workflow

Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

Make recon idempotent

Persist per-target state and only surface deltas, so re-runs are cheap and new assets stand out.

subfinder -d target.com -all -silent | dnsx -silent | anew hosts.txt | httpx -silent | notify

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Schedule recon; when anew emits new subdomains/URLs/JS, trigger a focused nuclei pass on just the new assets.

nuclei -l new-hosts.txt -severity critical,high -silent | notify -bulk

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Re-crawl and hash JS; alert on changed bundles (new endpoints/secrets) and newly appearing paths.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Route only high-signal events (new host, new critical, changed JS) to Slack/Discord. Noise kills automation.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Field notes

Continuous monitoring beats deep one-time scans for bounty ROI - you catch new deploys first.
Keep resolver lists and templates fresh via cron or the signal quality decays.

Related tools

Sources

Version history: normalized permanent page created 2026-08-20.