recon

6 posts tagged with recon.

2026-08-21reconbug bountypentesting6 min read

Nobody opens the documents

Everybody reads the JavaScript now. Almost nobody opens the PDFs, the spreadsheets and the decks a target publishes on purpose, and those carry staff names, internal paths, printer queues and database connection strings.

2026-04-27bug bountyreconweb security7 min read

The first thirty minutes on a new API

The JavaScript bundle gave you the frontend's idea of the API. The six steps below give you the backend's reality. Version probing, method expansion, parameter discovery, auth boundary checks, response signal.

2026-04-21bug bountyweb securityrecon7 min read

The first ten minutes on a new JavaScript bundle

Opening a stranger's bundled JavaScript for the first time. What I grep for, in what order and why. A practical follow-up to why you should not skip JS files at all.

2026-02-27bug bountypentestingrecon4 min read

Go wide before you go deep

The best vulnerabilities aren't on the main domain. Here's why wildcard scopes beat limited ones and how going wide leads to the findings that actually matter.

2026-02-26bug bountyweb securityrecon4 min read

Stop skipping JavaScript files

Running automated scans while ignoring JavaScript files means missing the real gold. Here's how reading JS files led to full admin access on a HackerOne target.

2025-02-04bug bountyreconRCE4 min read

The RCE hidden behind a forgotten endpoint

A development endpoint that shouldn't exist led to full remote code execution. Here's how thinking about impact turned one finding into a critical chain.