Upgrade to Pro — share decks privately, control downloads, hide ads and more …

The Bug Hunter’s Recon Methodology

Avatar for Tushar Verma Tushar Verma
August 08, 2021
Technology
2
790

The Bug Hunter’s Recon Methodology

Avatar for Tushar Verma

Tushar Verma

August 08, 2021
Tweet

More Decks by Tushar Verma

See All by Tushar Verma
The Power of Recon_ Leveraging Recon for Easy $$$$
Avatar for Tushar Verma e11i0t_4lders0n
0
200
AWS Cloud Forensics & Incident Response
Avatar for Tushar Verma e11i0t_4lders0n
1
700
Hacking OAuth Applications
Avatar for Tushar Verma e11i0t_4lders0n
1
2.1k
Exploiting SSRF like a Boss
Avatar for Tushar Verma e11i0t_4lders0n
2
1.1k
How to Fail at Bug Bounty Hunting
Avatar for Tushar Verma e11i0t_4lders0n
1
1.7k
METHODOLOGIES AND APPROACH TO START BUG BOUNTY HUNTING
Avatar for Tushar Verma e11i0t_4lders0n
0
600
Bypassing 2FA Misconfiguration
Avatar for Tushar Verma e11i0t_4lders0n
1
2.3k
How to get started in bug bounty
Avatar for Tushar Verma e11i0t_4lders0n
1
500

Other Decks in Technology

See All in Technology
Agentic AIが変革するAWSの開発・運用・セキュリティ ～Frontier Agentsを試してみた～ / Agentic AI transforms AWS development, operations, and security I tried Frontier Agents
Avatar for Yuji Oshima yuj1osm
0
170
「リリースファースト」の実感を届けるには 〜停滞するチームに変化を起こすアプローチ〜 #RSGT2026
Avatar for KintoTech_Dev kintotechdev
0
310
DATA SUMMIT 2025 生成 AI 時代におけるデータ分析基盤の在り方：オンプレミスからのクラウド移行とモダンデータスタックの実現
Avatar for Cold-Airflow coldairflow
0
100
アラフォーおじさん、はじめてre:Inventに行く / A 40-Something Guy’s First re:Invent Adventure
Avatar for 株式会社カミナシ kaminashi
0
210
会社紹介資料 / Sansan Company Profile
Avatar for Sansan, Inc. sansan33
PRO
11
390k
あの夜、私たちは「人間」に戻った。 ── 災害ユートピア、贈与、そしてアジャイルの再構築 / 20260108 Hiromitsu Akiba
Avatar for SHIFT EVOLVE shift_evolve
PRO
0
220
Strands Agents × インタリーブ思考 で変わるAIエージェント設計 / Strands Agents x Interleaved Thinking AI Agents
Avatar for Takanori Suzuki takanorig
6
2.5k
戰略轉變：從建構 AI 代理人到發展可擴展的技能生態系統
Avatar for Bo-Yi Wu appleboy
0
170
スクラムマスターが
スクラムチームに入って取り組む5つのこと
- スクラムガイドには書いてないけど入った当初から取り組んでおきたい大切なこと -
Avatar for scrummasudar scrummasudar
0
470
人工知能のための哲学塾 ニューロフィロソフィ篇 第零夜 「ニューロフィロソフィとは何か？」
Avatar for miyayou miyayou
0
230
"人"が頑張るAI駆動開発
Avatar for yoko yokomachi
1
670
通勤手当申請チェックエージェント開発のリアル
Avatar for WHIsaiyo whisaiyo
3
640

Featured

See All Featured
brightonSEO & MeasureFest 2025 - Christian Goodrich - Winning strategies for Black Friday CRO & PPC
Avatar for Christian Goodrich cargoodrich
2
74
Primal Persuasion: How to Engage the Brain for Learning That Lasts
Avatar for Mike Taylor tmiket
0
200
Tips & Tricks on How to Get Your First Job In Tech
Avatar for Honza Javorek honzajavorek
0
400
Faster Mobile Websites
Avatar for Dean Hume deanohume
310
31k
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
180
Measuring Dark Social's Impact On Conversion and Attribution
Avatar for Stephen Akadiri stephenakadiri
1
99
Bridging the Design Gap: How Collaborative Modelling removes blockers to flow between stakeholders and teams @FastFlow conf
Avatar for Kenny Baas-Schwegler baasie
0
410
DBのスキルで生き残る技術 - AI時代におけるテーブル設計の勘所
Avatar for soudai sone soudai
PRO
61
47k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
13k
How To Speak Unicorn (iThemes Webinar)
Avatar for Michelle Schulp Hunt marktimemedia
1
360
Save Time (by Creating Custom Rails Generators)
Avatar for Garrett Dimon garrettdimon
PRO
32
1.9k
Connecting the Dots Between Site Speed, User Experience & Your Business [WebExpo 2025]
Avatar for Tammy Everts tammyeverts
10
770

Transcript

  1. The Bug Hunter’s Recon Methodology By: Tushar Verma

  2. Whoami Application Security Engineer Synack Red Team Member Bug Bounty

    Hunter Infosec Trainer & Speaker

  3. Agenda Scope Review for any program Before Recon After Recon

    Scope- based Recon Basic Methodolog y Tools and Automation frameworks

  4. Scope review for any program • Assets • No of

    reports resolved • Payout • Time to triage and Time to Bounty

  5. Before Recon • Company name • Available scope • Overview

    about the company business • Information from program page related to security purposes

  6. After recon • Service info • Backend technology used •

    Interesting Endpoints • Juicy links which may be vulnerable • More and more

  7. Scope based recon • Small Scope Target-Single URL like domain

    and subdomain(Ex. evil.com , info.evil.com • Medium Scope Target-Lists of subdomains(Ex. *.evil.com) • Large Scope Target-All website related to company is in scope

  8. Basic Methodology Target : *.evil.com

  9. Tools and Automation Framework ReconF TW Project Bheem Osmed eus

  10. Get in touch at • Twitter: @e11i0t_4lders0n • LinkedIn: /in/tushars25

    • Instagram: @e11i0t_4lders0n__ • Email: [email protected]

  11. Thank you