hb-recon: Automating Bug Bounty Recon with AI

The Recon Problem

Manual reconnaissance is time-consuming:

1. Run subfinder → wait
2. Run httpx → wait
3. Run katana → wait
4. Run gf patterns → wait
5. Manually analyze results
6. Repeat for next target

This workflow wastes hours. What if we could automate everything and generate structured reports?

Introducing hb-recon

hb-recon is an automated reconnaissance workflow that:

• Chains multiple tools together
• Runs tasks in parallel
• Generates AI-ready JSON reports
• Scores risks automatically

What It Does

python -m hb_recon
# Enter: bugcrowd.com
 
# Wait 30-60 seconds...
 
# Results in recon_bugcrowd.com/:
# - subdomains.txt
# - alive.txt
# - urls.txt
# - xss.txt, sqli.txt, idor.txt
# - tech_stack.txt
# - ai_report.json  ← The magic

The Workflow

Domain Input
    ↓
1. Subfinder (subdomain enumeration)
    ↓
2. Httpx (live host detection)
    ↓
3. Parallel Execution:
    ├─→ WhatWeb (tech stack)
    └─→ Katana (endpoint crawl depth=3)
    ↓
4. gf (pattern matching: XSS, SQLi, IDOR)
    ↓
5. AI Report Generation

The AI Report

The killer feature: ai_report.json

{
  "target": "bugcrowd.com",
  "timestamp": "2026-06-20T13:45:00",
  "summary": {
    "subdomains": 15,
    "alive_hosts": 8,
    "endpoints": 324,
    "technologies": 12,
    "high_risk": 3,
    "medium_risk": 7,
    "low_risk": 15
  },
  "endpoints": [
    {
      "url": "https://admin.bugcrowd.com/api/users?id=123",
      "category": "idor",
      "risk": "high",
      "params": ["id"]
    }
  ],
  "tech_stack": {
    "server": "nginx/1.18.0",
    "frameworks": ["React", "Node.js"],
    "cms": null
  }
}

Using It With AI

The best part? Copy the report to ChatGPT/Claude:

You: "Analyze this recon data for vulnerabilities"
[Paste ai_report.json]

AI: "I found 3 high-risk endpoints:
1. IDOR in /api/users?id= - try parameter tampering
2. Potential XSS in search param - test with payloads
3. SQLi candidate in filter= - manual verification needed"

Tool Integration

hb-recon orchestrates these tools:

• subfinder - subdomain enumeration
• httpx - HTTP probing
• katana - web crawling
• whatweb - tech detection
• gf - pattern matching

All installed separately, but automated together.

Real-World Example

# Target: example.com
python -m hb_recon
 
[+] Subfinder + Httpx
[v] Done (5.2s)
 
[*] WhatWeb + Katana (parallel)...
[v] Done (12.4s)
 
[+] gf (XSS/SQLi/IDOR patterns)
[v] Done (1.8s)
 
[√] Total: 19.4s

Output Structure:

recon_example.com/
├── subdomains.txt (15 found)
├── alive.txt (8 live)
├── urls.txt (324 endpoints)
├── xss.txt (12 candidates)
├── sqli.txt (5 candidates)
├── idor.txt (8 candidates)
├── tech_stack.txt (nginx, React, etc.)
└── ai_report.json (AI-ready)

Installation

# Install tools first
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/projectdiscovery/katana/cmd/katana@latest
go install github.com/tomnomnom/gf@latest
sudo apt install whatweb
 
# Install hb-recon
pip install hb-recon

Use Cases

1. Bug Bounty: Fast recon on new programs
2. Pentesting: Client infrastructure mapping
3. OSINT: Organization footprinting
4. Research: Technology profiling

What's Next?

Future plans:

• [ ] Nuclei integration for vuln scanning
• [ ] API endpoint testing automation
• [ ] Multi-target batch processing
• [ ] Custom gf pattern support

Ethical Use Only

This tool is for:

• Authorized penetration testing
• Bug bounty programs (in scope)
• Your own infrastructure

Never scan unauthorized targets.

Get it on PyPI: pypi.org/project/hb-recon
Source: github.com/infohlaingbwar/hb-recon