Thread by @CristiVlad25

As much as I love automation in recon, 98% of the findings in my pentests have nothing to do with it. Why? 👇

1. Inspired by @NahamSec recent video.

First, in a large majority of the web pentests, clients want me to focus only on their app and it's features. So, there's no need for subdomain enumeration/bruteforcing or any other large recon tactic.

2. This doesn't mean that I don't use automation. I automate some of the boring and repetitive tasks via bash and python.

3. The majority of my testing is manual, mostly using Burp @PortSwigger, which is an ecosystem in of itself and it helped me find the great chunk of the hundreds of vulns I found in 2022 and 2023 alone.

4. Many of the pentests also involve code review, where most automation falls short. I found and keep finding a lot of gems by manually going through and reading code.

5. When I do network pentesting I use more automation, especially during the initial phase of the assessment, while mobile app pentesting is a combination of both.

6. The same applies to the few private bounties I participate in: some automation initially, more manual thereafter.

But but, I sell a recon course bit.ly/cybersecrecon

Yes, and that's a very solid foundation for all my current recon methods.

7. That said, automation can be very powerful, only when you're using it like no one else does.

If you're using the same tools with the same parameters (subfinder, nuclei, httpx) like everyone else, you should not expect much.

PRO tip: Code your own scripts and templates.

8. I'll probably write more about basic differentiated automation in recon in another thread here or on my blog at cristivlad.substack.com. Stay tuned!

#pentesting #appsec #infosec #cybersecurity #bugbounty #recon #hacking #ethicalhacking