How Attackers Map Your External Attack Surface

Before attacking, attackers map. Reconnaissance is often the most important phase of a successful attack, and in bug bounty hunting, good recon is frequently what separates hunters who find critical bugs from those who do not. Here is what that mapping looks like, so you can do it first.

Subdomain discovery

• Certificate transparency logs record every publicly trusted TLS certificate. Searching them reveals hostnames such as staging-api.example.com.
• Passive DNS datasets show historical DNS records.
• Search engines and web archives surface indexed pages on subdomains.
• Brute forcing common names like dev, admin, vpn and jenkins.
• Permutations of known names, such as api-v2, api-staging and api-eu.

Service discovery

• Port scanning of discovered hosts and IP ranges.
• Internet-wide scan databases that index exposed services by software and version.
• Cloud provider ranges, matched to your organisation through DNS and certificates.

Application discovery

• Crawling websites and recording every endpoint and parameter.
• JavaScript analysis: frontend bundles reveal API routes, internal hostnames, feature flags and sometimes keys.
• Source maps, when exposed, reveal the original code.
• Archived URLs from web archives, showing old endpoints that may still work.
• API documentation left public, such as Swagger UI or GraphQL introspection.

Organisational discovery

• Code repositories of the company and its employees.
• Package registries with internal package names.
• Job postings revealing technology stacks.
• Acquisitions and subsidiaries with their own infrastructure.

What attackers look for in the results

1. Hosts with outdated or vulnerable software.
2. Staging, development and test environments.
3. Admin panels and dashboards.
4. Dangling DNS records for subdomain takeover.
5. Exposed files and debug endpoints.
6. API endpoints not linked from the main app.

Running recon on yourself

A simple self-recon process:

1. Gather all your root domains, including old brands and acquisitions.
2. Enumerate subdomains through certificate transparency and DNS.
3. Resolve them and note which point to which providers.
4. Scan for open ports and identify services.
5. Crawl web services and extract endpoints from JavaScript.
6. Review each result: is it known, owned and meant to be public?

Then repeat it regularly, because new assets appear constantly.

Automating it

Manual recon is time-consuming, and the surface changes daily. SecurityInfinity's recon agent automates this whole process, using techniques refined by a founder ranked in HackerOne's global top 100, then hands every discovered asset to web, API and network agents for testing. Start free.

Frequently asked questions

Is reconnaissance illegal?

Passive recon using public data is generally lawful. Active scanning or testing of systems you do not own or have permission to test may not be. Only test your own assets or those you are authorised to test.

Why do bug bounty hunters focus on recon?

Because less-known assets are less tested. Finding a forgotten host often leads to vulnerabilities others missed.

Can I hide subdomains from certificate transparency?

Wildcard certificates avoid listing individual names, but subdomains can still be found via DNS and other sources. Assume they will be discovered.