Passive → active → rank → spider → secrets.

0:00–0:20 Recall: passive sources + ASN + takeover types

List crt.sh, subfinder passive, amass passive, assetfinder, gau archive. Then read Can-I-Take-Over-XYZ fingerprints.json — Heroku + S3 + GitHub Pages rows ONLY + bgp.he.net + asnlookup.com — 1 ASN lookup demo ONLY. Dangling types: CNAME/NS/MX/A.

0:20–1:10 Passive harvest: crt.sh + 3 tools → sort -u (VDP)

Run subfinder -d target -all -recursive -o subs.txt + amass enum -passive -d target + assetfinder --subs-only target + crt.sh %25.target CSV. sort -u → passive-day1.txt. THM subdomainenumeration T2 (crt.sh/Google site:) + T3 (dnsrecon/sublist3r) READ ONLY. No brute, no resolve yet.

1:10–2:00 Fingerprint study + H1 PoCs (read, no claiming)

Read 0xpatrik subdomain-takeover-basics — CNAME table + claim matrix ONLY + H1 #665398 (dig CNAME → NXDOMAIN → azurewebsites deploy) + #953719 (proxy-ssl.webflow 404 → paid-plan claim, screenshots F940499) ONLY + H1 #2567048 Smule SendGrid (claim to mark busy) thread ONLY.

2:00–2:35 ASN expand + acquisitions + alt-TLD sweep plan

Expand via amass intel -asn + bgp.he.net range ONLY. Check Crunchbase/Wikipedia acquisitions. Plan alt-TLD + reverse-WHOIS per HackTricks External Recon § ASN/WHOIS ONLY. THM passiverecon T2–T4 (whois/dig/shodan) ONLY.

2:35–3:00 Passive-before-brute test + gap log

Explain why brute before passive burns scope + triggers WAF. Log gaps (amass intel? alt-TLD tool?).

0:00–0:15 Wordlist choice: Assetnote vs commonspeak vs namelist

Compare SecLists Discovery/DNS subdomains-top1million-5000.txt + namelist.txt rows ONLY. Rule: VDP = top-5000 first, never million-scale day 2. Note Assetnote best-dns-wordlist existence.

0:15–1:05 Brute + dnsx resolve + httpx rank (VDP, in-scope)

Brute remaining namespace (small list). dnsx -l subs.txt -a -cname -resp -silent -o resolved.txt + wildcard check dnsx -wildcard row ONLY. httpx -l resolved.txt -td -cdn -title -status-code -silent -o live.txt. THM gobusterthebasics T5 DNS + T6 vhost + furthernmap T3 (-sS/-sV) READ ONLY.

1:05–2:00 Naming-signal top-10 + dev/staging writeup

Extract top-10 (dev/stage/admin/internal/api/mobile). Read pentester.land 1 dev/staging bug — note the hostname pattern ONLY + X search JS secrets bug bounty skim for naming thread.

2:00–2:35 WAF/CDN column + screenshots narrowed + outliers

Add WAF/no-WAF via wafw00f single-host + httpx -cdn ONLY. Screenshot top-10 only (not 500 hosts). Flag outliers: odd ports, old titles, huge content-length.

2:35–3:00 Ranking-order test + gaps

Recite: scope → naming → tech → newness → no-WAF. Triage gaps.

0:00–0:15 naabu vs nmap roles + httpx -td fields

State: naabu = fast SYN breadth, nmap -sV/-sC = depth on interesting only. Check naabu README top-ports + exclude-cdn rows ONLY + nmap -sSVC pattern (no live run). httpx fields: title/tech/cdn/status.

0:15–1:05 naabu top-1000 + nmap -sV on interesting + whatweb (VDP)

Run naabu -l live.txt -top-ports 1000 -exclude-cdn -o ports.txt. nmap -sV -sC -p<open> on ≤3 interesting hosts ONLY per THM furthernmap T3 (-sS/-sV/-O) + T11 NSE ONLY. whatweb -a 3 + wafw00f -i live.txt (gentle).

1:05–2:00 Tech clusters → bug-class expectations + CVE candidates

Cluster by HackTricks web fingerprint table ONLY (PHP/Node/Python/Java/Ruby/Go/.NET). Log versions → NVD + CISA KEV search (1 candidate, no exploit). Read pentester.land 1 exposed-panel/version→CVE case — note version string ONLY.

2:00–2:35 Shortlist interesting hosts (≤5) + nuclei tech dry-run (safe)

Pick ≤5 (staging + no-WAF + odd-port + old-stack). nuclei -u host -t http/misconfiguration/ -rate-limit 5 dry-run on 1 host ONLY (no vuln templates on live).

2:35–3:00 naabu vs nmap test + gaps

Recite roles + your shortlist rationale. Triage gaps.

0:00–0:15 katana vs gau vs hakrawler + arjun purpose

State roles, then check katana -d 5 -js-crawl + gau --subs + Arjun -m GET,POST flag rows ONLY.

0:15–1:05 katana -jc -xhr + gau + ffuf api/v1/FUZZ + arjun 1 run (shortlist hosts)

Run katana -u host -d 5 -js-crawl -o katana.txt + gau --subs host | httpx on ≤3 hosts. ffuf -u host/api/v1/FUZZ -w common.txt -mc 200,301 + arjun -u host/api -m GET,POST 1 run. THM contentdiscovery T2–T3 (robots/ffuf) + ffuf T5 (param FUZZ) ONLY.

1:05–2:00 Hidden vs duplicate vs alternate params + Swagger check

Classify found params. Probe /swagger/v1, /v3/api-docs, /api-docs, /openapi.json (4 paths, GET only). Read pentester.land 1 param-miner + 1 api-docs exposure — note param name + endpoint ONLY.

2:00–2:35 Param + API-version inventory for target

Build inventory: param → method → auth → reflection (Day-3 trace link). Note v1 vs v2 gaps for Week 10.

2:35–3:00 Param-type test + gaps

Recite hidden/duplicate/alternate with 1 example each. Triage gaps.

0:00–0:15 LinkFinder vs SecretFinder vs manual regex roles

State roles, then check LinkFinder -i -o cli -d 1 + SecretFinder -i -o cli usage ONLY. Regexes: AKIA[0-9A-Z]{16}, eyJhbGciOi, BEGIN PRIVATE KEY, x-amz-credential.

0:15–1:05 Extract JS → endpoints + secrets triage (3 largest bundles)

List JS URLs (katana + Sources). Run LinkFinder + grep fetch/axios + SecretFinder on 3 largest. Check source maps (.js.map) + /package.json exposure (GET only). THM walkinganapplication Debugger/Network revisit.

1:05–2:00 JS-secret + source-map writeups (key → impact)

Read PATT API Key Leaks 1 AWS-key case — validation steps ONLY + pentester.land 1 source-map/bundle exposure — note exposed path ONLY.

2:00–2:35 Internal URLs + Swagger-from-JS inventory

Flag internal/staging URLs + API hosts from JS. Re-probe Swagger paths from Day 4 with JS-found hosts. Log excessive-data candidates for Week 10.

2:35–3:00 3-secret-types test + gaps

Name 3 secret shapes + where each hides in JS. Triage gaps.

0:00–0:15 Dork operators + trufflehog/gitleaks roles

Memorize filename:.env AKIA "BEGIN PRIVATE KEY" org:target. Check trufflehog filesystem . --only-verified + gitleaks detect --source . -v rows ONLY.

0:15–1:05 Org dorks + dry-run on test repo + in-scope buckets

Run org dorks (read-only). Dry-run trufflehog/gitleaks on a TEST repo ONLY (never чужой full clone). Check buckets in-scope ONLY via cloud_enum -k target -m 50 + S3 URL pattern (BucketRegionalDomainName + ListBucketResult) READ. YT: github dorking bug bounty live, cloud_enum S3 takeover practical.

1:05–2:00 S3-misconfig + GitHub-leak→ATO writeups

Read PATT API Key Leaks 1 S3 case + pentester.land 1 GitHub-leak→ATO — validation + impact ONLY (no secret reuse).

2:00–2:35 Exposure notes + partial-redaction rule

Write notes with ***-1234 redaction. Rule: full secret/PII never stored. Reference WSTG INFO metafiles headings ONLY.

2:35–3:00 Dork + scope-respect test + gaps

Recite dork syntax + in-scope rule. Triage gaps.

0:00–0:20 Pipeline recall + WSTG INFO tick

Recite passive→resolve→rank→ports→spider→JS→dorks→diff. Tick WSTG checklist INFO rows + HuntBook Phase 1–2 headings ONLY.

0:20–1:20 Full passive→httpx→katana on VDP + diff vs Day 1

Run pipeline on VDP (gentle flags only). diff passive-day1.txt passive-day7.txt | tee diff.txt. New hosts = Week 03 priority. No vuln scans, no OOS.

1:20–2:20 Compare vs 1 published recon writeup

Read pentester.land 1 recon-methodology — stages vs yours ONLY. Log 1 missed stage (ASN? JS? alt-TLD?).

2:20–2:45 recon/ dir + ranked targets + reusable recon.sh

Save recon.sh snippet (subfinder→dnsx→httpx→katana→diff) + ranked list for Week 03 (staging/no-WAF/new first).

2:45–3:00 Pipeline recite + submit nothing + gaps

Recite full pipeline. Confirm no active/OOS violations. Assign gaps to Week 03.