A comprehensive, practitioner-grade reconnaissance framework for bug bounty hunting and red team operations.

The framework has been reorganized into a folderized structure to improve navigation and scalability. Each module contains detailed tool workflows, configuration notes, and operational checklists.

• VPS selection & secure provisioning.
• Setting up stealth redirectors (Nginx, CDNs) to protect team assets.
• Proxychains configuration and IP rotation techniques (Tor, AWS API Gateway / FireProx).
• Operational environment isolation and legal safe harbor compliance.

• Programmatic scope parsing from Bug Bounty platforms using bbscope.
• Business hierarchy mapping (acquisitions, subsidiaries) via public company registries (SEC, Crunchbase).
• Passive email and identity harvesting.
• Search engine dorking (Google Hacking Database) for sensitive data leakage.
• Threat intelligence search queries (Shodan, Censys, FOFA).
• Historical DNS and WHOIS tracking.

• Passive subdomain gathering using aggregators (subfinder, bbot, amass, assetfinder).
• Certificate Transparency (CT) log mining (direct SQL queries to crt.sh and real-time CertStream monitoring).
• Historical archive URL scraping (Wayback Machine, GAU).
• Ad-network tag correlation to link unknown assets.

• DNS bruteforcing and permutation workflows (puredns, gotator, dnsgen).
• Subdomain takeover verification mechanisms.
• ASN and IP space mapping (metabigor, BGP tables).
• Mass port scanning and version fingerprinting (masscan, nmap, rustscan).
• Virtual host fuzzing (ffuf).

• Recursive directory and file fuzzing (feroxbuster, ffuf).
• Active web crawling (katana).
• API and GraphQL schema discovery (kiterunner, arjun, clairvoyance).
• JavaScript analysis, endpoint extraction (linkfinder), and secret scanning (secretfinder).

• AWS storage bucket discovery, permission checks, and IMDSv1/v2 metadata retrieval.
• Google Cloud Storage bucket validation and metadata checks.
• Azure blob containers analysis and instance metadata.
• Multi-cloud storage scanning (cloudbrute).

• Technology stack detection and version matching.
• Parameter fuzzing, deduplication (uro), and injection mapping.
• Authentication analysis (JWT testing, OAuth 2.0 validation, session tracking).
• Automated vulnerability scanning pipelines using nuclei.

• New Module: In-depth analysis of stealth C2 infrastructure redirectors.
• Passive SSL/TLS Handshake Fingerprints: Overview of JA3/JA4 and JARM signature behaviors.
• Active Directory Discovery: Querying Microsoft 365 and Federated Identity Providers.
• Defense Evasion: Network scan rate optimization (low-and-slow) and protocol blending.
• Blue Team Detection: Writing Suricata rules, Sigma templates, and tracking beaconing signatures.

• Real-time CT monitoring and notification pipelines.
• Custom bash scripting for daily differential scanning.
• Distributed scanning architectures utilizing cloud fleets (axiom).
• Setting up notifier outputs (notify) for Discord and Slack.

• Writing high-impact vulnerability reports.
• Reference links for must-have wordlists.
• Unified one-liner cheat sheets (full domain resolution, exposed .git discovery, S3 enumeration).

Maintained by RemmyNine | Contributions welcome via PR.

The Scripts/ directory contains magnus.ps1 — a modular PowerShell recon automation script for bug bounty hunting.

.\Scripts\magnus.ps1 --recon example.com
.\Scripts\magnus.ps1 -gp example.com
.\Scripts\magnus.ps1 --vuln example.com --concurrency 15