A practical guide to chaining Subfinder, Nmap, Nuclei, FFUF, and SQLMap into an automated reconnaissance pipeline — so you can cover more scope in less time.
The reconnaissance phase is the most time-consuming part of a bug bounty engagement. Running Subfinder, piping results into httpx, then manually kicking off Nmap, then Nuclei, then FFUF — each step takes time to configure, execute, and collect. On a large scope with hundreds of subdomains, a full manual recon pass can take an entire day.
Automation solves this by chaining tools in a pipeline: each tool's output becomes the next tool's input, running sequentially or in parallel. The result is a structured finding set in 15–45 minutes instead of 4+ hours — and you can run it against multiple targets simultaneously.
PhantomRed runs this full pipeline automatically server-side. But if you want to build your own automation stack, here is the exact workflow, tool by tool.
Each tool handles a specific phase of reconnaissance. Together they cover the full external attack surface.
Discovers subdomains using passive sources — certificate transparency logs, DNS records, threat intel APIs. Fast and non-intrusive.
Deep subdomain enumeration using both passive and active techniques. Slower than Subfinder but finds more targets on large scopes.
Probes discovered subdomains to identify which are live, returning status codes, titles, and tech stack hints.
Scans open ports, identifies running services, detects software versions, and runs default NSE scripts for quick vulnerability hints.
Runs 9000+ community and official templates to detect CVEs, exposed panels, misconfigured headers, and known vulnerability patterns.
Discovers hidden directories, backup files, API endpoints, and unlinked admin panels via wordlist-based fuzzing.
Tests discovered endpoints for SQL injection vulnerabilities using automated payload injection and response analysis.
Collects email addresses, employee names, hostnames, and open ports from public sources like Google, LinkedIn, and Shodan.
This is the exact workflow PhantomRed runs server-side. If you are building your own automation, follow these steps in order — each feeds into the next.
Start by discovering all subdomains in scope. Subfinder uses passive sources (cert transparency, DNS APIs). Amass adds active brute-forcing for deeper coverage. Pipe both into httpx to filter for live hosts only.
Run Nmap against your live hosts to identify open ports, running services, and software version strings. The -sV flag detects service versions; -sC runs default NSE scripts for quick wins like anonymous FTP or open HTTP directories.
Nuclei runs community and official templates against your live hosts to detect known CVEs, exposed admin panels, default credentials, misconfigurations, and outdated software. This is often where the highest-impact findings come from without any manual effort.
FFUF discovers hidden paths — admin panels, backup files, config endpoints, unlinked API routes — that don't appear in normal browsing. Use a quality wordlist like SecLists' common.txt or raft-medium-directories.txt for best coverage.
Feed endpoints discovered in previous steps into SQLMap to test for SQL injection. Start with --batch to run non-interactively, and --level 2 for slightly deeper testing without being too noisy.
With dozens or hundreds of raw findings across tools, manual triage becomes a bottleneck. An AI layer can process all tool outputs, deduplicate related findings, assign severity-weighted risk scores, and produce a structured report — turning hours of triage into minutes.
Before running any scanner, read the program's rules of engagement carefully. Identify which subdomains, IP ranges, and endpoints are explicitly in scope. Never scan out-of-scope assets — it can get you banned or create legal liability.
Aggressive scanning can trigger WAFs, IP bans, or program disqualification. Use Nmap's -T3 timing, add --rate limits to FFUF, and avoid running multiple heavy scans against the same host simultaneously.
Don't run every Nuclei template blindly — use severity filters (-severity critical,high) for initial passes. The -tags cve and -tags misconfig filters are high signal-to-noise for bug bounty work.
Always write tool outputs to files with -o or -oN flags. Raw outputs are useful for re-analysis, sharing with a team, or feeding into AI triage tools. Structure your output directory by target and date.
Subdomain enumeration expands your attack surface significantly before port scanning. Running Nmap directly against a root domain misses dozens of subdomains with their own open ports and services.
If you don't want to manage the toolchain locally — installations, wordlists, template updates, output parsing — PhantomRed runs the full pipeline server-side and delivers a structured, AI-analyzed report. Free tier includes 3 scans/month.
Dive deeper into the tools and workflows that power autonomous penetration testing.
PhantomRed chains Nmap, Nuclei, FFUF, and SQLMap server-side. Submit a target and get a risk-scored report in minutes. Free tier — no credit card required.