Hands-Free Recon: Orchestrating Event-Driven Security Pipelines

Manual reconnaissance during bug bounty hunting or attack surface management is slow, error-prone, and unsustainable across hundreds of subdomains. The most effective security engineers do not spend hours manually typing nmap and subfinder into terminals; they build automated pipelines that alert them only when high-value state changes occur.

1. Principles of Event-Driven Recon

A robust automation engine follows three core architectural principles:

1. Idempotence: Running the pipeline against the same target multiple times should produce consistent state and avoid spamming alerts.
2. Delta Detection: Only surface changes—newly discovered hostnames, altered HTTP status codes, or newly exposed ports.
3. Decoupled Workers: Ingestion, scanning, enrichment, and notification should run as independent modular steps.

2. A Minimalist Bash & Webhook Pipeline

Here is a practical pattern using standard CLI tools (subfinder, anew, and notify via Discord/Telegram webhooks):

#!/usr/bin/env bash
# Continuous Subdomain Monitor
TARGET="example.com"
DB_DIR="$HOME/.recon/$TARGET"
mkdir -p "$DB_DIR"

echo "[*] Harvesting current subdomains for $TARGET..."
subfinder -d "$TARGET" -silent | anew "$DB_DIR/all_subs.txt" > "$DB_DIR/new_subs.txt"

NEW_COUNT=$(wc -l < "$DB_DIR/new_subs.txt")

if [ "$NEW_COUNT" -gt 0 ]; then
    echo "[+] Found $NEW_COUNT new hostnames! Probing HTTP endpoints..."
    httpx -l "$DB_DIR/new_subs.txt" -title -tech-detect -status-code -silent \
        | notify -provider-config "$HOME/.config/notify/provider-config.yaml"
fi

3. Distributed Task Automation

When scaling beyond a single VPS, orchestrating jobs using lightweight task queues or containerized serverless functions ensures that heavy scanning routines do not congest your primary auditing environment. Automate the routine, and reserve your manual creativity for complex vulnerability chains.