If you do bug bounty, you know the drill: long scopes, piles of subdomains, IPs, ports, and entry points—and the targets worth your time are hard to spot.
ReconHunter is not a point-and-shoot scanner. It pulls domains, IPs, ports, URLs, certificates, and fingerprints from bounty programs into one place so you can search, filter, and connect the dots. It helps you narrow down what to look at inside scope; you still do the testing.
What gets indexed?
Mostly Web attack surface, broken down a few practical ways:
- Domains：Root and subdomains, DNS, CNAME chains, resolved addresses—scoped per program.
- IPs & ports：Which IPs are in scope, what ports are open, what services run—including fingerprints like Tomcat or Redis.
- Web URLs：Titles, status codes, icon hashes, component fingerprints, plus tags for CDN, WAF, admin surfaces, and the like.
- Site paths：Paths from directory brute force and crawling—what lives below the root URL.
- TLS certificates：CN, organization, SAN, cert fingerprints—useful for finding other domains on the same certificate.
A few views group exposure by shape—not “here is a CVE,” but “this looks like admin” or “this port is odd”:
- High-risk apps: weak components and admin frameworks
- Admin panels: login pages and back-office entry points exposed externally
- High-risk ports: databases, remote admin, common middleware ports
Where does the data come from?
Approved, in-scope Bug Bounty and SRC programs, collected on a schedule in the background—not from you clicking scan in the UI.
Global
- HackerOne, Bugcrowd, YesWeHack, Intigriti, Federacy, HackenProof, and more
China
- China SRC platforms, vendor-hosted bounty pages, and ENScan-enriched related domains
Vendor-hosted bounty policy pages are indexed too. Platforms without auto-sync are noted; if the policy page has full scope, it can be imported manually.
When is it useful?
Just getting started
You don’t need a full playbook on day one. Default login pages, admin consoles, phpMyAdmin, Swagger—these stand out. Filter for sites that look easier first, then spend time where the odds and payout are better.
You have a bug, need targets
Fresh 0-day or 1-day on a product that public intel hasn’t caught up with yet? Fingerprint search across indexed bounty scope finds programs still running that stack—so verification and submission stay in-scope and worth the effort.
You already have one lead
There is usually more nearby. Same site: sibling paths, versions, deployment templates. Same subnet: similar misconfigs. Spot phpMyAdmin, Swagger, or Tomcat, then follow admin entry points, shared templates, and shared certs—the circle gets small fast.
How is it different from a scanner?
If you expect “enter domain → run scan → get a report,” this will feel different.
| ReconHunter | Typical scanner / ASM | |
|---|---|---|
| Purpose | Bounty program asset intel | Scanning / ASM |
| What you do | Search, filter, correlate | Often trigger scans and PoCs yourself |
| Data source | Indexed bounty scope | Often any domain you type in |
| What you get | What assets look like and how they connect | Vuln reports and risk scores |
It does not test for you—it helps you decide what to look at first and where to expand next.
How to use it
- Pick an in-scope target from the approved program list.
- Start from high-risk apps, admin panels, ports, or Web fingerprints—don’t burn time on static landing pages.
- Drill into one asset and expand via IP, cert, or fingerprint; verify yourself and submit on the right platform.
Who it fits—and who it does not
Researchers with a fresh 0-day or 1-day who want fingerprint search across bounty scope to find programs still running that product.
Newcomers who want to start with fingerprints and admin entry points and pick a few sites that look worth trying first.
Not the right tool if you want one-click vuln reports, scan-any-domain workflows, or smart-contract auditing.
Compliance
ReconHunter is asset intel only—no vulnerability probing, PoCs, or exploitation. There is no one-click scan in the UI, and you cannot change backend collection parameters.
What you see here is how sites, admin surfaces, fingerprints, and certificates relate—so you know where to look. Whether to test, whether it is in scope, and whether you may submit are your calls under each program’s rules.
The focus is Web attack surface: domains, IPs, ports, URLs, certificates. Smart contracts and on-chain work are out of scope.
Community & feedback
Product updates, public Q&A, and feature suggestions — find us on X.
Follow us on XDo not post sensitive scope, credentials, or account details in public channels.