Building a Recon Workflow With ProjectDiscovery Tools
Subfinder into httpx into nuclei. Three tools, one pipe, and the whole external surface of an authorised target.
Reconnaissance on an authorised engagement is mostly a data pipeline: find the names, find the live ones, find the interesting ones. Three tools and a pipe cover the majority of it.
The pipeline
subfinder -d example.com -silent \
| httpx -silent -status-code -title -tech-detect \
| nuclei -severity medium,high,criticalsubfinder enumerates subdomains from passive sources — certificate transparency, public datasets — without touching the target.
httpx resolves which of those actually respond, with status, title and detected technology. This is the step that turns a list of names into a list of systems.
nuclei runs templated checks against what is live.
Unix composition is the whole design, and it means you can insert your own steps anywhere.
What the output is really for
The finding list matters less than the inventory. On every engagement I have run, the most valuable output was the client discovering assets they had forgotten:
- A staging environment on a public subdomain with no authentication
- A marketing microsite from a campaign three years ago, unpatched since
- An old admin panel that was supposed to have been decommissioned
- A developer's demo instance with production data in it
None of those needed an exploit. They needed someone to notice they existed.
Doing it responsibly
Written authorisation before anything. Scope, dates, and what is out of bounds. Passive enumeration is gentler than scanning, but the moment httpx sends a request you are touching their systems.
Respect the boundary. Subdomain enumeration finds hosts that belong to other people — a shared platform, a third-party service. Those are not in scope because they resolve from a name you were given.
Throttle against production. Default concurrency can affect a small server. Slow it down and tell the client when you are running.
Report the inventory, not just the vulnerabilities. The asset list is often the most actionable thing you deliver.
Making it repeatable
I keep the pipeline in a script with the scope baked in, and run it on a schedule for clients whose infrastructure I maintain. New subdomains appearing without anyone mentioning them is a useful early signal — that is how you find out marketing spun up a site with an agency.
Resources
- projectdiscovery/subfinder
- projectdiscovery/httpx
- projectdiscovery/nuclei
- Video walkthroughs: YouTube: subfinder httpx nuclei workflow
- Writing your own checks: Nuclei templates
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
