Recon & OSINT

Recon — Asset Discovery

Find every subdomain, IP, and live host a target owns. The starting point of every bug bounty engagement.

Beginner35 min5 lessons1 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Enumerate subdomains with DNS brute force and certificate transparency
✓Find IP ranges and ASN ownership from WHOIS and ARIN
✓Discover shadow IT and forgotten assets outside the main domain
✓Map the full external attack surface of an organisation

Lessons

1How a Forgotten Subdomain Cost Uber $148 Million
2What is Asset Discovery — and Why You Start Here
3Tools — Subfinder, httpx & Amass in One Recon Chain
4Mini Lab — Reading httpx and Subfinder Output
5Your Turn: Map the Attack SurfaceHANDS-ON