Recon → live hosts → nuclei

The canonical bug-bounty one-liner: enumerate subdomains, resolve, probe live HTTP, and scan for known issues.

Level: beginner

Tools: subfinder, dnsx, httpx, nuclei

Pipeline

subfinder -d {domain} -all -silent | dnsx -silent | httpx -silent | nuclei -severity critical,high -o nuclei.txt

`/`	Focus search on this page
`Ctrl` `K`	Search everything (command palette)
`1`-`9`	Hunt / field / bench / intel (see clusters)
`0`	AI / MCP connector
`j` / `k`	Move selection down / up
`Enter`	Expand / open selected
`c`	Copy primary command of selected
`f`	Toggle favorite on selected tool
`Esc`	Clear search / close