Overview
Recon can surface many assets, so prioritization — deciding which to focus on — makes hunting efficient. This lesson covers prioritizing recon findings.
Learning objectives
- Explain why prioritization matters in recon.
- Describe factors for prioritizing assets.
- Connect prioritization to efficient hunting.
Core concept
Prioritization is ranking discovered in-scope assets by their likely value for finding vulnerabilities, so limited time is spent where it is most productive. Since recon often yields many assets, testing them all equally is inefficient. Factors that raise an asset's priority include: newer or less-tested assets, those with more functionality or sensitive features (authentication, payments, admin, APIs), complex or custom applications (more likely to have flaws), and assets that appear less hardened. Prioritization directs effort toward the assets most likely to yield valuable findings.
How it works
After discovery, the researcher assesses each asset against value factors and ranks them: an asset with rich, sensitive functionality (e.g. an application handling accounts and payments) or a newly-launched, less-tested service ranks higher than a static, simple, or clearly well-hardened one. They then focus hunting on the high-priority assets first, while keeping the others in the backlog. This is a strategic decision — bug bounty rewards finding valuable vulnerabilities efficiently, so spending time where flaws are likely and impactful (high-functionality, sensitive, less-tested assets) is far more productive than testing everything uniformly.
Practical example
Recon on a program yields many assets: a large, feature-rich application with authentication and payments; a newly-launched API; a static marketing page; and an old, simple tool. The researcher prioritizes the feature-rich application and the new API (rich/sensitive functionality, likely less-tested) over the static page (little attack surface). They focus their hunting there first, where valuable vulnerabilities are more likely. Prioritization made their limited time far more productive than testing every asset equally.
Cybersecurity relevance
Prioritization is a key efficiency and strategy skill in bug bounty: with finite time and many assets, focusing on high-value targets (rich/sensitive functionality, new/less-tested, complex assets) maximizes the chance of finding impactful, well-rewarded vulnerabilities. It reflects risk-based thinking — concentrating effort where impact and likelihood are highest. It builds on asset discovery (you prioritize what you found) and feeds the actual hunting. Good prioritization distinguishes effective researchers, who find valuable bugs efficiently, from those who spread effort thinly across low-value assets.
Common mistakes
- Testing all assets equally, wasting time on low-value targets.
- Ignoring value factors (functionality, sensitivity, novelty, hardening) when ranking.
- Never revisiting the backlog of lower-priority assets after high-value ones.
Key takeaways
- Prioritization ranks discovered in-scope assets by likely value, focusing limited time where vulnerabilities are most likely and impactful.
- Value factors: newer/less-tested assets, rich/sensitive functionality (auth, payments, admin, APIs), complex/custom apps, and less-hardened assets.
- It is a strategic efficiency skill reflecting risk-based thinking; it builds on discovery and feeds hunting, distinguishing effective researchers.
Check your understanding
- What factors make an asset higher-priority for bug bounty hunting?
- Why is prioritizing assets more effective than testing every discovered asset equally?