From ab656f5d2cf724b54b553b5cdc16bea2c107fe08 Mon Sep 17 00:00:00 2001 From: miguel Date: Mon, 19 Oct 2026 10:39:32 +0100 Subject: [PATCH] fix(recon): always include the seed host in the HTTP probe list Deep (4+-level) hostnames, DNS-only zones and internal names return nothing from passive subdomain enum, so the domain branch produced an empty all.txt and Phase 2 skipped HTTP probing entirely. Mirrors the ip/local seeding. Verified against tenant.dast.complear.com. --- bughunter/tools/recon_engine.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/bughunter/tools/recon_engine.sh b/bughunter/tools/recon_engine.sh index 59f0b273..3da7ed87 100755 --- a/bughunter/tools/recon_engine.sh +++ b/bughunter/tools/recon_engine.sh @@ -361,6 +361,14 @@ cat "$RECON_DIR/subdomains/"*.txt 2>/dev/null | sort -u > "$RECON_DIR/subdomains TOTAL_SUBS=$(wc -l < "$RECON_DIR/subdomains/all.txt" 2>/dev/null || echo 0) log_ok "Total unique subdomains: $TOTAL_SUBS" +# Always include the seed host itself: deep (4+-level) hostnames, DNS-only +# zones and internal names return nothing from passive enum, and the app +# often lives exactly on the seed (mirrors the ip/local seeding above). +echo "${TARGET}${TARGET_PORT:+:$TARGET_PORT}" >> "$RECON_DIR/subdomains/all.txt" +sort -u -o "$RECON_DIR/subdomains/all.txt" "$RECON_DIR/subdomains/all.txt" +TOTAL_SUBS=$(wc -l < "$RECON_DIR/subdomains/all.txt" 2>/dev/null || echo 0) +log_ok "Seed host included; probe list now: $TOTAL_SUBS host(s)" + fi # end of domain-only subdomain enum block # ============================================================