Three Pillar Recon Suite

Automation suite for bug bounty recon, asset discovery, vulnerability testing, and LLM context generation.

Overview

The tool operates across three specialized pillars:

Pillar 1: Deep JS Analysis

• Crawls and downloads JavaScript bundles using Katana and GAU.
• Detects source maps (.js.map) to expose uncompiled source code.
• Scans for cloud secrets and credentials (AWS, GCP, Firebase, Supabase, Stripe, GitHub PATs, JWTs, RSA Keys).
• Extracts internal API routes and query parameters.
• Identifies DOM XSS sources and sinks.

Pillar 2: Proxy and Multi-Agent AI Context

• Generates structured JSON context for LLM agents and Burp MCP servers.
• Generates 5 dedicated agent prompts (Pentester, Searcher, Coder PoC, Reflector QA, Rez0 Hackbot).
• Generates vulnerability skills matrix (hunt-xss, hunt-idor, hunt-ssrf, hunt-oauth, hunt-graphql, cors-chain).

Pillar 3: Subdomains, Non-Standard Ports, and Active Vulns

• Passive DNS lookup via Certificate Transparency logs (crt.sh).
• Subdomain enumeration via Subfinder.
• Non-standard web port scanner (80, 443, 8000, 8080, 8443, 8888, 9000, 9443) using Naabu or Nmap.
• Subdomain Takeover check via CNAME fingerprinting.
• CORS misconfiguration scanner (arbitrary origin reflection and credentials check).
• GraphQL introspection scanner.
• SSRF and Open Redirect parameter miner.
• Live target validation via Httpx.
• Optional active vulnerability scanner via Nuclei.

Installation and Requirements

Automatic dependency check and installer:

./three_pillar_recon.sh --install-only

Required or recommended tools:

• Go 1.20+
• Subfinder
• Katana
• Httpx
• Ffuf
• Nuclei (optional)
• Naabu (optional)
• GAU / Waybackurls
• Arjun / Linkfinder

Usage

Basic scan:

./three_pillar_recon.sh -t target.com

Parallel execution for 5x speed:

./three_pillar_recon.sh -t target.com --parallel

Full scan with active Nuclei vulnerability checks and Webhook notification:

./three_pillar_recon.sh -t target.com --parallel --nuclei --webhook "https://discord.com/api/webhooks/YOUR_WEBHOOK_URL"

Show help menu:

./three_pillar_recon.sh --help

Output Structure

Default output path: ~/Downloads/three_pillar_recon/<target>/

• js_analysis/: Downloaded JS files, secrets, source maps, DOM sinks, endpoints.
• proxy_context/: Burp XML, AI context JSON, 5 agent prompts, skills checklist.
• recon/: Subdomains, open ports, live hosts, takeovers, CORS findings, API routes.
• reports/: Markdown reports per pillar, combined report, and interactive dashboard.html.