RedSec
Bug bounties

Recon and scoping

Map a target's attack surface — subdomains, content, parameters, and stack.

intro tutorial

You can’t exploit what you haven’t found. Most real findings come from surface the defenders forgot about — old endpoints, staging hosts, hidden parameters.

Enumerate subdomains

Passive sources give you hostnames without touching the target:

Passive subdomain enumeration
subfinder -d example.com -silent | tee subs.txt

Then resolve which are live:

Probe for live hosts
cat subs.txt | httpx -silent -status-code -title

Discover content

Crawl and brute-force for hidden paths and parameters:

Content discovery
ffuf -u https://example.com/FUZZ \
     -w /usr/share/seclists/Discovery/Web-Content/raw.txt \
     -mc 200,204,301,302,401,403

Fingerprint the stack

Fingerprinting
whatweb https://example.com

Knowing the framework, server, and CMS tells you which bug classes to prioritize.

Keep a living map of hosts, endpoints, inputs, and trust boundaries — then start hunting bug classes.