Recon notes: what I look at before touching a target
Whenever I get a new scope (in a lab or a bug bounty program), I spend the first hour on the boring stuff: robots.txt , sitemap.xml , well-known endpoints Response headers — the CSP usually tells you what the team cares about JS bundles for API paths and feature flags Historical URLs (Wayback, common crawl) None of it is clever. But it consistently gives me a map before I start guessing. I keep a…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.