recon-playbook

1# External Web Recon Playbook
2 
3Use this playbook to turn an authorized root domain or asset list into a
4prioritized map of web applications, APIs, authentication boundaries, and
5testable security hypotheses.
6 
7```text
8scope
9  -> assets
10  -> DNS and services
11  -> routes and client code
12  -> APIs and identities
13  -> hypotheses
14  -> focused validation
15  -> evidence and reporting
16```
17 
18## When to Use
19 
20- Beginning an external web, API, or bug bounty assessment.
21- Recon output exists but lacks normalization, provenance, or prioritization.
22- The target spans multiple applications, subdomains, or identity boundaries.
23- A broad scan needs to be converted into focused manual validation.
24 
25Do not use this playbook to justify activity outside the agreed scope or to run
26every available tool against every asset.
27 
28## Prerequisites
29 
30- Explicit authorization, target boundaries, exclusions, rate limits, and stop
31  conditions.
32- `curl`, `jq`, `subfinder`, `dnsx`, `httpx`, and `katana`.
33- `nmap` only when IP or port discovery is in scope.
34- Approved test identities for authorization and session testing.
35- A writable evidence directory.
36 
37## How to Run
38 
39```bash
40export TARGET="example.test"
41export OUTPUT_DIR="${OUTPUT_DIR:-./output/$TARGET}"
42 
43mkdir -p \
44  "$OUTPUT_DIR/assets" \
45  "$OUTPUT_DIR/http" \
46  "$OUTPUT_DIR/urls" \
47  "$OUTPUT_DIR/evidence"
48```
49 
50Run each phase only after reviewing the preceding output. Keep raw source files
51so every hostname, URL, and hypothesis has provenance.
52 
53## Procedure
54…