Red Team Tools and Methodology

Combine multiple sources for coverage: run Amass in passive and active modes, Subfinder, and Assetfinder, then generate permutations with dnsgen. Merge all results with sort -u and probe them with httpx to find live hosts.

Extract parameters with ParamSpider or waybackurls, filter them with Gxss, then pipe the results into Dalfox with mining enabled. This automates payload injection and reflection detection across discovered parameters.

You need a Linux machine with Go-based tools: Amass, Subfinder, Assetfinder, httpx, httprobe, ffuf, Nuclei, Dalfox, waybackurls, and gau. Some features also require API keys for services like Shodan or Censys.

Nuclei should only be run against hosts within your authorized bug bounty scope. It supports template-based scanning for CVEs, technologies, and vulnerabilities, but results can include false positives requiring manual verification.

Aggressive scanning triggers target rate limits and WAF blocks. Reduce concurrency, add delays between requests, or use proxy rotation, and always respect the program's rules of engagement.

Automated tools generate false positives and miss logic flaws, authentication issues, and business-logic bugs. Manual testing with Burp Suite and application analysis, such as the Jason Haddix heat map method, remains necessary.