Automate Your Recon Process and Uncover More Vulnerabilities

As a hacker, your reconnaissance process is critical for finding vulnerabilities in your target's infrastructure. However, the traditional recon process can be time-consuming and repetitive. In this blog post, we will show you how to automate your recon process and discover more vulnerabilities using tools like Xray, Nuclei, and Cent.

The traditional recon process involves finding subdomains, getting live subs, and testing them for vulnerabilities. To make the process more efficient, we recommend using tools like Subfinder, Assetfinder, Amass, Github-subdomains, and Sublist3r.

Here is an example script to help you get started

• subfinder -d $1 -silent | anew /root/$1/subs.txt
• assetfinder -subs-only $1 | anew /root/$1/subs.txt
• amass enum -passive -d $1 | anew /root/$1/subs.txt
• python sublist3r.py -d $1| anew /root/$1/subs.txt
• github-subdomains -t <github token> -d $1 | anew /root/$1/subs.txt

Once you have the subdomains, you need to check for open ports and get live hosts using tools like Naabu and Httpx.

Here is an example script

• cat /root/$1/subs.txt | naabu -p — -silent | anew open-ports.txt
• cat open-ports.txt | httpx -silent | anew alive.txt

Once you have identified the live hosts, you can start testing for vulnerabilities. There are two types of vulnerabilities you can test for - CVEs and misconfigurations, and generic vulnerabilities.

For CVEs and misconfigurations, you can use Nuclei, a powerful tool that can detect a wide range of vulnerabilities. You can create custom templates for Nuclei or use existing ones from the Project Discovery templates.

To test all Nuclei templates on GitHub, we recommend using Cent, a tool that collects all templates of Nuclei from other repositories on GitHub and combines them into one repository.

Here is an example script

• cat alive.txt | nuclei -t /path/to/cent/ -es info | anew nuclei-results.txt

For generic vulnerabilities, we recommend using Xray, a fantastic tool to test for vulnerabilities with a crawler built-in. Xray can crawl every host and test generic vulnerabilities for all params on the URL and Body request.

Here is an example script

• for i in $(cat /root/$1/alive.txt); do xray_linux_amd64 ws — basic-crawler $i — plugins xss,sqldet,xxe,ssrf,cmd-injection,path-traversal — ho $(date +”%T”).html ; done

With these tools, you can automate your bug hunting process and focus on other things. You can use the above scripts to create an automated workflow and run it periodically to stay up-to-date on any vulnerabilities.

Automating your recon process can save you a lot of time and effort. With tools like Xray, Nuclei, and Cent, you can discover more vulnerabilities and stay ahead of the curve.