How do I use this reconnaissance template for bug bounty hunting?

Use the template as a step-by-step checklist during the initial recon phase. Start with 'Domain Enumeration' to find the scope, move to 'Subdomain Enumeration' to expand targets, and finally use 'Fingerprinting' to identify vulnerabilities in the 'Technology Stack' of the discovered assets.

Is this reconnaissance cheat sheet editable in Xmind?

Yes, the template is fully editable. You can add your own custom 'Wordlist' sources, update command-line flags for tools like 'Gobuster', or include new 'JS Parsing' techniques as your personal methodology evolves.

What tools are mentioned in the Reconnaissance BB playbook v1?

The playbook references several industry-standard tools including 'Amass' for intel, 'Massdns' for resolution, 'EyeWitness' for screenshots, and 'Shodan' for IP fingerprinting. It also includes specific syntax for 'whois' and directory brute-forcing.

reconnaissance v1

Abdelrhman Allam

Loading preview...

Use cases

Task breakdown

About

The reconnaissance v1 mind map template is a comprehensive technical playbook designed for cybersecurity professionals, bug bounty hunters, and penetration testers. Covering 58 distinct nodes, this reconnaissance cheat sheet provides a structured workflow for information gathering across five critical phases: Domain Enumeration, Wordlist selection, Subdomain Enumeration, Content Discovery, and Fingerprinting. It serves as a tactical guide for mapping an organization's digital footprint, integrating specific command-line instructions for tools like 'Amass', 'Gobuster', and 'Massdns'. The template details advanced techniques such as 'Certification Transparency Logs' for subdomain discovery and 'JS Parsing' for extracting hidden endpoints and secrets from JavaScript files. By organizing complex methodologies into a visual hierarchy, it ensures that security researchers do not overlook critical steps like 'Reverse Whois' or 'ASN Lookup' during the initial stages of an engagement.

reconnaissancecybersecurityinformation gathering

Terms and Conditions

When to use this template

Security Researchers and Penetration Testers

Starting a new bug bounty program or penetration test engagement

DevSecOps Engineers

Building an automated reconnaissance pipeline or script workflow

Cybersecurity Students and Junior Analysts

Learning the fundamentals of modern information gathering techniques

How to use this template

Step 1

Import the playbook file

Download and open the .xmind file in Xmind to view the full 'Reconnaissance BB playbook v1' structure.

Step 2

Customize tool commands

Navigate to nodes like 'Brute Force w/Gobuster' and replace the placeholder flags with your preferred local paths and wordlists.

Step 3

Track your progress

Use Xmind markers or checkboxes to mark off completed phases such as 'Fingerprinting' or 'Content Discovery' during a live engagement.

Frequently asked questions

This template includes a structured breakdown of 58 nodes covering domain and subdomain enumeration, content discovery, and fingerprinting. It features specific tool commands for 'Amass', 'NMap', and 'EyeWitness', along with advanced techniques like 'JS Parsing' and 'Google Dork' strategies for comprehensive information gathering.

Got an inspiring template?

Share your mind map templates with creators around the world and start earning from your work.

Free template