Overview
Bug bounty recon starts with asset discovery — finding all the in-scope systems a program exposes. A systematic methodology maximizes coverage. This lesson covers asset discovery in recon.
Learning objectives
- Explain asset discovery in bug bounty recon.
- Describe building a broad, in-scope asset picture.
- Connect discovery to a repeatable methodology.
Core concept
Asset discovery is systematically finding the systems within a program's scope — subdomains, applications, APIs, and related assets — to build a comprehensive picture of the authorized attack surface. In bug bounty, thorough discovery is a competitive advantage: the more (in-scope) assets you find, the more opportunities to identify vulnerabilities others miss. Discovery combines the techniques from later modules (subdomain enumeration, asset correlation, fingerprinting) into a methodology — a repeatable workflow — always constrained to the program's in-scope definition.
How it works
Following a recon methodology, the researcher discovers assets across the in-scope surface: enumerating subdomains (under in-scope wildcards), identifying applications and APIs, and correlating related assets — using passive and (permitted) active techniques. Each discovered asset is verified against the scope before being treated as a target. Discovery is methodical and repeatable (a defined workflow) so coverage is thorough and consistent, and it is documented (notes) for later prioritization and testing. The goal is a complete, in-scope asset picture that reveals where to hunt.
Practical example
For a program with *.example.com in-scope, the researcher runs their recon methodology: enumerating subdomains, identifying the applications and APIs on them, and correlating related in-scope assets — building a broad list of authorized targets. Each discovered asset is checked against the scope (respecting exclusions). The result is a comprehensive, in-scope asset picture that reveals many potential testing targets, some of which less-thorough researchers would miss. This breadth of authorized surface is where bug bounty opportunity begins.
Cybersecurity relevance
Thorough asset discovery is central to bug bounty success: the authorized attack surface is where vulnerabilities live, and finding more in-scope assets (especially overlooked ones) yields more opportunities. It mirrors attacker and pentest recon but is bounded by the program scope. A systematic, repeatable methodology ensures consistent coverage. For organizations, it underscores maintaining an accurate asset inventory (you can't secure unknown assets). Asset discovery feeds the prioritization, note-keeping, deduplication, and validation steps that make recon effective — and ultimately the vulnerability hunting.
Common mistakes
- Unsystematic discovery, missing in-scope assets and opportunities.
- Not verifying discovered assets against scope before treating them as targets.
- Not documenting discoveries for later prioritization and testing.
Key takeaways
- Asset discovery systematically finds in-scope systems (subdomains, applications, APIs, related assets) to map the authorized attack surface.
- Thorough, methodical, repeatable discovery maximizes coverage and opportunity — finding more in-scope assets is a bug bounty advantage.
- Verify each discovered asset against scope and document it; discovery feeds prioritization, deduplication, and validation, and ultimately vulnerability hunting.
Check your understanding
- Why is thorough asset discovery a competitive advantage in bug bounty?
- Why must each discovered asset be verified against the program scope?