What to Do After Choosing a Bug Bounty Target? Part 2 | Bug Bounty Guide

In Part 1, we covered the basics of bug bounty reconnaissance, including subdomain enumeration, scanning, tech identification, and basic vulnerability hunting. Now, let’s dig into some deeper recon methods like Google Dorking, analyzing JavaScript files, and exploring hidden content.

1. Google Dorking: Digging Deeper with Search

What is Google Dorking?
Google Dorking (or Google hacking) involves using advanced search operators on Google to find hidden or sensitive information. It’s a great way to discover exposed data that’s not immediately visible. This technique can uncover pages containing emails, login portals, configuration files, and more. Think of it as a way to hack Google to search smarter.

Here are some resources to help get started with Google Dorking:

Simplilearn’s Google Dorking Guide — Learn the basics of Google Dorking.Exploit DB’s Google Hacking Database — A collection of Google search operators (called “dorks”) to find publicly available sensitive data.

Other helpful tools for easy access to Google Dorks:

Google Dorks for Bug BountyBug Bounty HelperBug Bounty Search Engine

Using these dorks, you can find files, emails, and other hidden data that could lead to vulnerabilities on your target site.

2. Analyzing JavaScript Files for Secrets

JavaScript files often contain useful information, like hidden API endpoints or keys. To start, collect a list of all the .js files from your recon phase and filter them out like this:

cat urls.txt | grep '.js$'

For a more advanced tool, try katana, which scrapes JavaScript files and is particularly helpful for large scopes:

katana -u https://target.com -jc -d 2 | grep ".js$" | uniq | sort > js.txt

Once you have the list of JS files, use tools like SecretFinder to identify any sensitive data (like API keys or tokens) within them:

cat js.txt | while read url; do python3 SecretFinder.py -i $url -o cli >> secrets.txt; done

If you find API keys and aren’t sure what they’re used for, KeyHacks is a handy resource that lists possible exploits and testing tips for different API keys. This can help you leverage those keys in your reports.

Additionally, using the Wayback Machine can sometimes provide snapshots of older JavaScript files that might still contain useful information, especially if those files have since been modified or removed from the live site.

3. Content Discovery: Uncovering Hidden Endpoints and Directories

Content discovery is the process of finding hidden directories, files, or pages on a website. This step is crucial in recon, as these hidden areas can contain important information or vulnerabilities.

To get started with content discovery, here are some popular tools:

FeroxBuster — A fast and recursive content discovery tool that searches for multiple directories automatically.GoBuster — Another reliable tool for brute-forcing directories and files.Dirb and Dirbuster — Both provide strong directory and file enumeration capabilities.

Using FeroxBuster with a wordlist that matches the technology stack of your target site can improve results. For example, if your target uses WordPress, use a WordPress-specific wordlist for better findings. A helpful collection of such lists can be found in SecLists, which includes wordlists for various platforms and technologies.

Sample Command with FeroxBuster:

feroxbuster -u https://target.com -w /path/to/wordlist.txt -o report.txt

This command will automatically find additional directories under the paths it discovers, potentially revealing other sensitive locations.

To save time, consider creating a simple script that runs these tools on your list of subdomains, aggregating the results in a report. This way, you get an organized view of all discovered content for analysis.

For further study, here are some great resources for bug bounty hunters:

Book of Bug Bounty Tips — A compilation of bug bounty strategies, scripts, and methodologies.Pentest Book by Six2dez — A wealth of pentesting and bug bounty techniques.HackTricks — A go-to site for exploitation tips and techniques across various categories.