🥷 Building a Real Bug Bounty Recon Pipeline (BLACKBELT v3)

Most beginners in bug bounty make the same mistake:

They run tools randomly… Collect thousands of URLs… And have no idea what to do next.

This article fixes that.

I’m going to show you how to build a structured, automated recon pipeline using a custom script:

👉 BLACKBELT v3

This is not theory. This is something you can actually run.

🧠 Why You Need a Recon Framework

Manual recon looks like this:

• Run subfinder
• Run httpx
• Run gau
• Run nuclei
• Forget where outputs are
• Duplicate results
• Waste hours

A framework solves this by:

✅ Organizing data ✅ Automating workflow ✅ Reducing noise ✅ Saving time

⚙️ What BLACKBELT v3 Does

This script chains together:

• Subdomain discovery
• Live host detection
• URL collection
• Parameter extraction
• Vulnerability scanning
• Fuzzing
• Network scanning

Tools used:

• subfinder
• assetfinder
• httpx
• gau
• uro
• qsreplace
• gf
• ffuf
• nuclei
• nmap
• anew (for deduplication)

📦 Step 1 — Install Required Tools

Run:

go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/lc/gau/v2/cmd/gau@latest
go install github.com/tomnomnom/anew@latest
go install github.com/tomnomnom/qsreplace@latest
go install github.com/tomnomnom/gf@latest
go install github.com/ffuf/ffuf@latest
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/s0md3v/uro@latest
go install github.com/tomnomnom/assetfinder@latest

Then:

export PATH=$PATH:$(go env GOPATH)/bin

Update nuclei templates:

nuclei -update-templates

🧾 Step 2 — Create the Script

Save this as:

blackbelt_v3.sh

Make it executable:

chmod +x blackbelt_v3.sh

🧩 BLACKBELT v3 Script

#!/bin/bash

set -e

TARGET_INPUT=$1
BASE_DIR="bb-framework"
DATA_DIR="$BASE_DIR/data"
OUT_DIR="$BASE_DIR/output"

mkdir -p "$DATA_DIR" "$OUT_DIR"

echo "[+] BLACKBELT MODE STARTED"

if [ -z "$TARGET_INPUT" ]; then
    TARGET_FILE="$DATA_DIR/targets.txt"
else
    TARGET_FILE="$DATA_DIR/targets.txt"
    echo "$TARGET_INPUT" | tr ',' '\n' > "$TARGET_FILE"
fi

while read domain; do

    DOMAIN_DIR="$OUT_DIR/$domain"
    mkdir -p "$DOMAIN_DIR"

    echo "[+] Target: $domain"

    subfinder -d "$domain" -silent | anew "$DOMAIN_DIR/subs.txt"
    assetfinder --subs-only "$domain" | anew "$DOMAIN_DIR/subs.txt"

    cat "$DOMAIN_DIR/subs.txt" | httpx -silent | anew "$DOMAIN_DIR/live.txt"

    cat "$DOMAIN_DIR/subs.txt" | gau | uro | anew "$DOMAIN_DIR/urls.txt"

    cat "$DOMAIN_DIR/urls.txt" | grep "=" | qsreplace FUZZ | anew "$DOMAIN_DIR/params.txt"

    nuclei -l "$DOMAIN_DIR/live.txt" -o "$DOMAIN_DIR/nuclei.txt"

    ffuf -u https://$domain/FUZZ \
         -w /usr/share/wordlists/dirb/common.txt \
         -mc 200,301,302,403 \
         -o "$DOMAIN_DIR/ffuf.json" \
         -of json

    nmap -iL "$DOMAIN_DIR/live.txt" -T2 -oN "$DOMAIN_DIR/nmap.txt"

done < "$TARGET_FILE"

echo "[+] DONE"

🚀 Step 3 — How to Use It

Single target:

./blackbelt_v3.sh target.com

Multiple targets:

./blackbelt_v3.sh "example.com,tesla.com,github.com"

File input:

echo "playtika.com" > bb-framework/data/targets.txt
./blackbelt_v3.sh

📂 Output Structure

bb-framework/
├── data/
│   └── targets.txt
└── output/
    └── target.com/
        ├── subs.txt
        ├── live.txt
        ├── urls.txt
        ├── params.txt
        ├── nuclei.txt
        ├── ffuf.json
        └── nmap.txt

⚠️ Important Notes (Read This)

• Always respect program scope
• Avoid aggressive scanning unless allowed
• Nmap can trigger alerts — use carefully
• Fuzzing can generate noise — filter results

🧠 What You Should Do Next

Don’t just run the script.

Learn how to:

• Analyze params.txt
• Investigate nuclei.txt
• Manually test endpoints
• Chain vulnerabilities

That’s where real bugs are found.

🏁 Final Thoughts

Tools don’t find bugs.

You do.

This framework just removes the chaos so you can focus on what matters:

👉 Finding real vulnerabilities.

👉 Clap 👏 👉 Follow Investing Made Simple 👉 Share 👉 Repost 🔁 👉 Share Widely With Others learning about investing