vulns.cofield index
Enter
Contribute
Testing playbook · beginner

Full Recon Methodology

End-to-end attack-surface mapping: from a root domain to a prioritized list of live, interesting hosts.

reconasset-discoverymethodology
Stable IDplaybook:recon-methodologyLast updatedLast verifiedLegacy review pendingProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

01

Enumerate subdomains (passive)

Aggregate multiple passive sources and dedup. Passive first - it's fast and stealthy.

subfinder -d target.com -all -silent | anew subs.txt; assetfinder --subs-only target.com | anew subs.txt
subfinderamassassetfinderanew
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Bruteforce subdomains (active)

Add coverage with a DNS wordlist and fresh resolvers, filtering wildcards.

puredns bruteforce best-dns-wordlist.txt target.com -r resolvers.txt -w brute.txt
puredns
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Resolve & find live HTTP

Resolve everything, then probe which hosts actually serve HTTP and enrich with title/tech.

cat subs.txt brute.txt | dnsx -silent | httpx -sc -title -tech-detect -o live.txt
dnsxhttpx
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
04

Triage visually

Screenshot everything and skim for admin panels, dev/staging, default installs, and odd tech.

gowitness scan file -f live.txt
gowitness
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
05

Scan for known issues

Run nuclei across live hosts, starting at critical/high to keep noise down.

nuclei -l live.txt -severity critical,high -o nuclei.txt
nuclei
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • Refresh your resolvers.txt regularly - stale resolvers cause false positives.
  • Keep a per-target folder and use anew so re-runs only surface new assets.
  • Staging/dev subdomains are gold - they're often less hardened.
Related tools

Mapped workflow tools

ToolamassToolanewToolassetfinderTooldnsxToolgowitnessToolhttpxToolnucleiToolpurednsToolsubfinder
Sources

References

Version history: normalized permanent page created 2026-08-20.