Ethical Hacking Academy · Lesson

Recon at Scale

Automate discovery.

Recon at Scale is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Recon Wins Bounties

In bug bounty hunting, reconnaissance often decides who finds the bug first. The more attack surface you discover, the more likely you are to find something others missed.

Forgotten subdomains run old, vulnerable code
Hidden APIs and dev environments leak data
The widest recon usually finds the freshest bugs

Recon at scale means automating discovery across large scopes.

Subdomain Enumeration: Passive

Passive enumeration gathers subdomains from public data sources without touching the target directly: certificate transparency logs, search indexes, and threat-intel feeds.

Tools aggregate dozens of these sources at once.

# Aggregate subdomains from many passive sources
subfinder -d example.com -all -o subs_passive.txt

# Amass in passive mode
amass enum -passive -d example.com

Subdomain Enumeration: Active

Active enumeration brute-forces names against DNS using wordlists, finding hosts that are not in any public source.

Pair a fast resolver with a good wordlist for best results.

# Brute-force subdomains with massdns-style resolution
puredns bruteforce wordlist.txt example.com -r resolvers.txt

# Permutation-based discovery from known subdomains
dnsgen subs.txt | puredns resolve -r resolvers.txt

Resolving and Filtering Live Hosts

A raw subdomain list is noisy. Resolve each name to confirm it points somewhere, then probe which respond over HTTP/HTTPS.

This trims dead entries and gives you a list of live web servers worth testing.

# Probe which hosts serve HTTP/HTTPS and capture status/title
cat subs.txt | httpx -sc -title -tech-detect -o live.txt

# Example line
# https://api.example.com [200] [API Gateway] [nginx]

Port Scanning at Scale

Web ports are not the whole story. Mass port scanning finds services on non-standard ports across thousands of hosts.

Use a fast scanner for discovery, then a detailed scanner for service fingerprinting.

# Fast internet-scale port discovery
naabu -list resolved_ips.txt -top-ports 1000 -o ports.txt

# Detailed service/version detection on found ports
nmap -sV -iL ports.txt -oA nmap_detail

Content Discovery

Within each live host, hidden paths reveal admin panels, backups, and APIs. Content discovery fuzzes paths against a wordlist.

Filter by status code and response size to cut noise.

# Directory and file fuzzing
ffuf -u https://app.example.com/FUZZ \
  -w wordlist.txt -mc 200,301,403 -o ffuf.json

# Alternative
feroxbuster -u https://app.example.com -w wordlist.txt

Mining JavaScript Files

Modern apps put logic in JavaScript. Those files leak API endpoints, parameter names, secrets, and even hardcoded keys.

Collect all JS files from a host
Extract URLs, endpoints, and tokens

# Pull endpoints from a JS file
curl -s https://app.example.com/main.js | grep -Eo 'https?://[^"]+'

# Dedicated link/endpoint extractor
cat js_urls.txt | gau | grep '\.js$' | sort -u

Historical URLs and Archives

Old URLs that no longer appear on the live site may still be reachable, and vulnerable. Archives like the Wayback Machine remember them.

These often expose deprecated endpoints with weaker security.

# Pull historical URLs from multiple archives
gau example.com > urls.txt
waybackurls example.com >> urls.txt

# Keep ones with interesting parameters
sort -u urls.txt | grep '?' | tee params.txt

Building an Automated Pipeline

Recon at scale means chaining these tools so one feeds the next. A pipeline runs end to end with a single command.

Frameworks let you schedule recon to re-run and alert you when new assets appear.

# A minimal chained pipeline
subfinder -d example.com -silent \
  | httpx -silent \
  | nuclei -t cves/ -o findings.txt

# Continuous recon frameworks: reconftw, axiom

Templated Vulnerability Scanning

Once you have a list of live hosts, template-based scanners check each for known issues: exposed panels, default creds, known CVEs, misconfigurations.

This finds the low-hanging fruit fast so you can focus manual effort elsewhere.

# Run community templates against live hosts
nuclei -list live.txt -t exposures/ -t misconfiguration/ -o nuclei.txt

# Tune severity to reduce noise
nuclei -list live.txt -severity high,critical

Recon Responsibly

Automation can hammer a target. Stay within program rules:

Respect rate limits, throttle aggressive scanners
Only resolve and scan in-scope assets, wildcards can resolve to third parties
Avoid intrusive payloads during pure discovery

Confirm a discovered host is genuinely in scope before testing it.

Quick Check

Which technique discovers subdomains WITHOUT sending traffic directly to the target's infrastructure?

Recap: Recon at Scale

You learned to map large attack surfaces efficiently.

Passive enumeration uses public sources; active brute-forces DNS
Resolve and probe to keep only live hosts
Mine JavaScript and archived URLs for hidden endpoints
Chain tools into an automated pipeline feeding a template scanner
Always throttle and verify scope before scanning

Next: turning that surface into actual bugs, IDOR, XSS, and SSRF.

Frequently asked questions

Is the “Recon at Scale” lesson free?

Yes — the full text of “Recon at Scale” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Recon at Scale”?

Automate discovery. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Recon at Scale” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy