sowmya9162/Recon-Pipeline
GitHub: sowmya9162/Recon-Pipeline
模块化的漏洞赏金侦察流水线，将子域名枚举、爬虫、JS分析和漏洞扫描等独立安全工具串联为一套自动化端到端工作流。
Stars: 0 | Forks: 0
# 自动化漏洞赏金侦察流水线
一个模块化的端到端侦察和漏洞测试流水线，适用于授权的漏洞赏金和安全研究项目 —— 从被动子域名发现到手动漏洞利用和报告。
## 流水线概述
```
flowchart TD
A[Target] --> B[Passive Recon]
B -->|Subfinder, Assetfinder, Amass, BBOT, crt.sh, Chaos| C[Active Recon]
C -->|dnsx, httpx, naabu| D[Merge & Deduplicate]
D --> E[Live Hosts]
E --> F[Crawling]
E --> G[Fingerprinting]
F -->|Katana depth 5, gau, waymore| H[Endpoint Collection]
G -->|httpx, Wappalyzer| H
H --> I[URL Analysis]
H --> J[JS Analysis]
H --> K[Interesting Files]
H --> L[Fingerprints]
J -->|API keys, secrets, hidden APIs,
source maps, GraphQL, internal URLs, tokens| M[Parameter Mining] K -->|.zip/.7z, backups, .env,
config/log files, DB & git backups, docs| M I --> M M -->|ParamSpider, Arjun, custom extraction| N[Parameter Testing] N -->|XSS, SQLi, Open Redirect,
SSRF, LFI, SSTI, IDOR| O[Automation] O -->|Nuclei, Dalfox, Feroxbuster,
ffuf, Nikto, OWASP ZAP| P[Prioritization] P -->|Auth, AuthZ, Business Logic, API/GraphQL,
JWT, OAuth, Session Mgmt, File Upload,
AI Features, Info Disclosure, Race Conditions,
Rate Limiting, Subdomain Takeover,
Cache Poisoning/Deception, Broken Link Hijacking| Q[Validate] Q -->|PoC, Evidence, Impact, Reproduction| R[Report] ```
## 为什么创建此项目
大多数公开的侦察教程都只是孤立地讲解单个阶段。本项目将各个阶段串联在一起，使一个工具的侦察输出可以自动作为下一个工具的输入 —— 从而减少了工具之间手动复制粘贴的操作，并确保在所有目标上采用统一的方法论。
## 模块
| 阶段 | 脚本 | 使用的工具 |
|---|---|---|
| 被动侦察 | `modules/01_passive_recon.sh` | subfinder, assetfinder, amass, bbot, crt.sh, chaos |
| 主动侦察 | `modules/02_active_recon.sh` | dnsx, httpx, naabu |
| 爬取与指纹识别 | `modules/03_crawl_and_fingerprint.sh` | katana, gau, waymore, httpx, wappalyzer |
| JS 分析 | `modules/04_js_analysis.sh` | 自定义 grep/regex 单行命令 |
| 有趣的文件 | `modules/05_interesting_files.sh` | 自定义扩展名匹配 |
| 参数挖掘 | `modules/06_param_mining.sh` | paramspider, arjun |
| 自动化扫描 | `modules/07_automated_scan.sh` | nuclei, dalfox, feroxbuster, ffuf, nikto |
| 报告脚手架 | `modules/08_report_scaffold.sh` | 生成 PoC/证据/影响模板 |
## 环境要求
请先安装底层工具（其中大部分基于 Go 语言）：
```
# 基于 Go 的工具
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install -v github.com/tomnomnom/assetfinder@latest
go install -v github.com/lc/gau/v2/cmd/gau@latest
go install -v github.com/ffuf/ffuf/v2@latest
# 基于 Python 的工具
pip install arjun --break-system-packages
pip install uro --break-system-packages
# 其他：amass, bbot, waymore, paramspider, feroxbuster, nikto, dalfox
# 有关每个 OS 的完整设置说明，请参阅 docs/INSTALL.md。
```
## 使用说明
```
git clone https://github.com//bug-bounty-recon-pipeline.git
cd bug-bounty-recon-pipeline
chmod +x recon.sh modules/*.sh
# 针对范围内的 target 运行完整 pipeline
./recon.sh -d example.com -o output/example.com
# 运行单个 stage
./modules/01_passive_recon.sh example.com output/example.com
```
## 输出结构
```
output//
├── subdomains/
│ ├── all.txt
│ └── live.txt
├── ports/
├── endpoints/
│ ├── urls.txt
│ ├── js_files.txt
│ └── interesting_files.txt
├── js_analysis/
│ ├── secrets.txt
│ ├── endpoints.txt
│ └── source_maps.txt
├── params/
├── scans/
│ ├── nuclei_results.txt
│ └── ffuf_results.txt
└── report/
└── findings_template.md
```
## 路线图
- [ ] 子域名接管检测（dnsx + nuclei 接管模板）
- [ ] 缓存投毒 / 缓存欺骗检查
- [ ] 失效链接劫持检测
- [ ] 针对 JS/配置中发现的名称，执行针对 npm/PyPI 的依赖混淆检查
- [ ] 通过 Slack/Discord webhook 发送新发现的通知
## 免责声明
本项目仅用于教育和授权的安全测试目的。作者不对任何滥用行为负责。请始终遵守目标项目的交战规则，并保持在授权范围内。
## 许可证
MIT 许可证 —— 详见 [LICENSE](LICENSE)。
source maps, GraphQL, internal URLs, tokens| M[Parameter Mining] K -->|.zip/.7z, backups, .env,
config/log files, DB & git backups, docs| M I --> M M -->|ParamSpider, Arjun, custom extraction| N[Parameter Testing] N -->|XSS, SQLi, Open Redirect,
SSRF, LFI, SSTI, IDOR| O[Automation] O -->|Nuclei, Dalfox, Feroxbuster,
ffuf, Nikto, OWASP ZAP| P[Prioritization] P -->|Auth, AuthZ, Business Logic, API/GraphQL,
JWT, OAuth, Session Mgmt, File Upload,
AI Features, Info Disclosure, Race Conditions,
Rate Limiting, Subdomain Takeover,
Cache Poisoning/Deception, Broken Link Hijacking| Q[Validate] Q -->|PoC, Evidence, Impact, Reproduction| R[Report] ```
文本版本
``` Target │ ├─ Passive Recon → Subfinder, Assetfinder, Amass, BBOT, crt.sh, Chaos ├─ Active Recon → dnsx, httpx, naabu ├─ Merge & Deduplicate ├─ Live Hosts │ ├─ Crawling → Katana, gau, waymore │ └─ Fingerprinting → httpx, Wappalyzer ├─ Endpoint Collection │ ├─ URL Analysis │ ├─ JS Analysis → API keys, secrets, hidden APIs, source maps, GraphQL, internal URLs, tokens │ ├─ Interesting Files → .zip/.7z, backups, .env, config/log files, DB & git backups, docs │ └─ Fingerprints ├─ Parameter Mining → ParamSpider, Arjun, custom extraction ├─ Parameter Testing → XSS, SQLi, Open Redirect, SSRF, LFI, SSTI, IDOR ├─ Automation → Nuclei, Dalfox, Feroxbuster, ffuf, Nikto, OWASP ZAP ├─ Prioritization → Auth, AuthZ, Business Logic, API/GraphQL, JWT, OAuth, │ Session Mgmt, File Upload, AI Features, Info Disclosure, │ Race Conditions, Rate Limiting, Subdomain Takeover, │ Cache Poisoning/Deception, Broken Link Hijacking ├─ Validate → PoC, evidence, impact, reproduction steps └─ Report ```标签：Cutter, Docker部署, GitHub, 子域名枚举, 实时处理, 密码管理, 日志审计, 漏洞奖励, 系统安全, 自动化流水线, 运行时操纵, 逆向工具