h-mmer Recon Methodology
Phase 1: Passive (no direct contact)
Subdomain Enumeration
subfinder -d target.com -silent -all | sort -u > subs.txt
httpx -l subs.txt -silent -status-code -tech-detect | tee live-hosts.txt
URL Discovery
gau target.com | sort -u > historical-urls.txt
waybackurls target.com | sort -u >> historical-urls.txt
grep -E "\?.*=" historical-urls.txt > params.txt
grep -iE "api|admin|internal|debug|test|staging" historical-urls.txt > interesting.txt
Tech Detection
curl -sI https://target.com | grep -iE "server|x-powered|x-runtime|x-generator"
Phase 2: Active (light contact)
Content Discovery
ffuf -u https://target.com/FUZZ -w wordlists/common.txt -mc 200,301,302,403
ffuf -u https://target.com/api/FUZZ -w wordlists/api-endpoints.txt -mc 200,401,403,405
JS Analysis
katana -u https://target.com -d 3 -jc -ef css,png,jpg,gif | grep "\.js$" | sort -u > js-files.txt
# Grep for secrets and endpoints in downloaded JS
grep -rohE '/api/[a-zA-Z0-9/_-]+' downloaded-js/ | sort -u
Phase 3: Organize
Key Output Files
recon/<target>/
├── live-hosts.txt — verified live hosts with tech
├── urls.txt — all discovered URLs
├── api-endpoints.txt — API paths
├── js-analysis.txt — secrets and endpoints from JS
├── idor-candidates.txt — URLs with ID parameters
├── ssrf-candidates.txt — URLs with URL/redirect parameters
└── tech-stack.txt — technology summary
Extract Candidates
# IDOR candidates:
grep -E '/[0-9]+|id=|user_id=|order_id=' urls.txt > idor-candidates.txt
# SSRF candidates:
grep -iE 'url=|uri=|redirect=|next=|dest=|callback=' urls.txt > ssrf-candidates.txt
After recon: run /surface for P1/P2/Kill ranking.