Automation & Scaling

Let tools do the repetitive work while you focus on finding bugs

What You'll Discover

🔧 Your First Automated Pipeline

Chain tools together for automated discovery. Create this script and run it:

#!/bin/bash
# recon.sh - Automated reconnaissance pipeline
# Usage: ./recon.sh target.com

# --- WHAT THIS SCRIPT DOES ---
# 1. Takes a domain as input
# 2. Finds all subdomains
# 3. Checks which are live
# 4. Gets historical URLs
# 5. Saves everything to organized files

# --- THE CODE ---

TARGET=$1  # $1 means "first argument passed to script"

# Safety check: Make sure a target was provided
if [ -z "$TARGET" ]; then
    echo "Usage: ./recon.sh target.com"
    exit 1  # Exit with error code
fi

# Create output directory for this target
OUTPUT_DIR="./recon/$TARGET"
mkdir -p $OUTPUT_DIR  # -p creates parent directories if needed

echo "[*] Starting recon for $TARGET"
echo "[*] Results will be saved to $OUTPUT_DIR"

# Step 1: Subdomain enumeration
echo "[+] Finding subdomains..."
subfinder -d $TARGET -silent -o $OUTPUT_DIR/subdomains.txt
SUBDOMAIN_COUNT=$(wc -l < $OUTPUT_DIR/subdomains.txt)
echo "    Found $SUBDOMAIN_COUNT subdomains"

# Step 2: Probe for live hosts
echo "[+] Checking which hosts are alive..."
cat $OUTPUT_DIR/subdomains.txt | httpx -silent -o $OUTPUT_DIR/live_hosts.txt
LIVE_COUNT=$(wc -l < $OUTPUT_DIR/live_hosts.txt)
echo "    Found $LIVE_COUNT live hosts"

# Step 3: Get historical URLs from Wayback Machine
echo "[+] Fetching historical URLs..."
echo $TARGET | waybackurls > $OUTPUT_DIR/wayback_urls.txt
WAYBACK_COUNT=$(wc -l < $OUTPUT_DIR/wayback_urls.txt)
echo "    Found $WAYBACK_COUNT historical URLs"

# Step 4: Summary
echo ""
echo "=== RECON COMPLETE ==="
echo "Target:     $TARGET"
echo "Subdomains: $SUBDOMAIN_COUNT"
echo "Live hosts: $LIVE_COUNT"
echo "Wayback:    $WAYBACK_COUNT URLs"
echo "Output:     $OUTPUT_DIR/"

To use this script:

# 1. Save the script as recon.sh
# 2. Make it executable:
chmod +x recon.sh

# 3. Run it:
./recon.sh target.com

# Results appear in ./recon/target.com/

Skills You'll Master

Understanding Automation in Bug Bounty

Automation Techniques

Continuous Subdomain Monitoring

This script runs daily, compares today's subdomains with yesterday's, and alerts you to new discoveries:

#!/bin/bash
# monitor.sh - Alert on new subdomains
# Run daily via cron job

TARGET=$1
DATA_DIR="./monitor/$TARGET"
mkdir -p $DATA_DIR

# File paths
OLD_SUBS="$DATA_DIR/subs_previous.txt"
NEW_SUBS="$DATA_DIR/subs_current.txt"
DIFF_FILE="$DATA_DIR/subs_new.txt"

# Get current subdomains
echo "[*] Scanning $TARGET for subdomains..."
subfinder -d $TARGET -silent -o $NEW_SUBS

# First run? Just save the baseline
if [ ! -f "$OLD_SUBS" ]; then
    cp $NEW_SUBS $OLD_SUBS
    echo "[*] First run - baseline saved"
    exit 0
fi

# Compare: Find subdomains in NEW that aren't in OLD
# comm -13 shows lines unique to file 2 (new subdomains)
comm -13 <(sort $OLD_SUBS) <(sort $NEW_SUBS) > $DIFF_FILE

# Check if we found anything new
if [ -s "$DIFF_FILE" ]; then  # -s checks if file has content
    NEW_COUNT=$(wc -l < $DIFF_FILE)
    echo "[!] Found $NEW_COUNT NEW subdomains!"
    echo ""
    cat $DIFF_FILE
    echo ""

    # Optional: Send notification (uncomment and configure)
    # notify_discord "New subdomains for $TARGET: $(cat $DIFF_FILE)"
else
    echo "[*] No new subdomains found"
fi

# Update baseline for next run
cp $NEW_SUBS $OLD_SUBS

# --- TO RUN DAILY ---
# Add to crontab (run: crontab -e)
# 0 6 * * * /path/to/monitor.sh target.com >> /path/to/monitor.log 2>&1
#
# This runs at 6 AM every day
# Cron format: minute hour day month weekday command

Nuclei Vulnerability Scanning

Nuclei uses templates to scan for known vulnerabilities. It's like having thousands of security checks automated:

# INSTALLATION
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Update templates (run regularly - new vulns added often)
nuclei -update-templates
# What it does: Downloads latest vulnerability detection templates
# Templates cover: CVEs, misconfigs, exposed panels, takeovers, etc.

# ─────────────────────────────────────────────────────────

# SCANNING EXAMPLES

# Scan all live hosts with all templates
nuclei -l live_hosts.txt -o all_findings.txt
# Warning: This can take hours on large lists. Start targeted.

# Scan for subdomain takeovers only
nuclei -l live_hosts.txt -t takeovers/ -o takeovers.txt
# What it does: Checks for GitHub Pages, Heroku, S3, etc. takeovers
# Fast scan, high-value findings

# Scan for exposed admin panels
nuclei -l live_hosts.txt -t exposed-panels/ -o panels.txt
# What it does: Finds login pages, admin interfaces, dashboards
# Good for finding forgotten admin panels

# Scan for critical and high severity only
nuclei -l live_hosts.txt -severity critical,high -o critical_findings.txt
# Use when you want to focus on impactful issues

# Scan for specific CVEs
nuclei -l live_hosts.txt -t cves/2024/ -o cve_findings.txt
# Tests for known vulnerabilities from 2024

# ─────────────────────────────────────────────────────────

# INTERPRETING RESULTS

# Nuclei output format:
# [template-id] [severity] [protocol] [matched-url] [extracted-info]
#
# Example:
# [git-config-exposure] [medium] [http] [https://target.com/.git/config]
#
# This tells you:
# - What was found (git-config-exposure template matched)
# - Severity (medium)
# - Where (https://target.com/.git/config)
#
# IMPORTANT: Nuclei finds POTENTIAL issues
# Always verify findings manually before reporting

Notification Integration

Get alerts when automation finds something interesting:

# Discord Webhook Notification
# 1. Create webhook: Server Settings → Integrations → Webhooks → New Webhook
# 2. Copy the webhook URL

notify_discord() {
    local MESSAGE="$1"
    local WEBHOOK_URL="https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_TOKEN"

    # Send POST request to Discord
    curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"content\": \"$MESSAGE\"}"
}

# Usage in your scripts:
if [ -s "$DIFF_FILE" ]; then
    notify_discord "🔔 New subdomains found for $TARGET: $(cat $DIFF_FILE | tr '\n' ' ')"
fi

# ─────────────────────────────────────────────────────────

# Slack Webhook (similar approach)
notify_slack() {
    local MESSAGE="$1"
    local WEBHOOK_URL="https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK"

    curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"text\": \"$MESSAGE\"}"
}

# ─────────────────────────────────────────────────────────

# Telegram Bot Notification
notify_telegram() {
    local MESSAGE="$1"
    local BOT_TOKEN="YOUR_BOT_TOKEN"
    local CHAT_ID="YOUR_CHAT_ID"

    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d "chat_id=${CHAT_ID}" \
        -d "text=${MESSAGE}"
}

# Tip: Keep webhook URLs in a separate config file, not in scripts
# source ~/.config/notify_config.sh

Automation Success Stories

Responsible Automation Practices

Frequently Asked Questions

🎯 You Can Automate Your Hunting!

Recon pipelines, continuous monitoring, Nuclei scanning, notifications - you now have the tools to scale your bug bounty efforts. Your automation runs while you sleep, catching new assets before competitors.

Ready to build your bug bounty career →