Recon notes: what I look at before touching a target

Whenever I get a new scope (in a lab or a bug bounty program), I spend the first hour on the boring stuff:

• robots.txt, sitemap.xml, well-known endpoints
• Response headers — the CSP usually tells you what the team cares about
• JS bundles for API paths and feature flags
• Historical URLs (Wayback, common crawl)

None of it is clever. But it consistently gives me a map before I start guessing.

I keep a small Nuclei template set and a notes file per target. The notes are worth more than the tools.

Currently reading about Kotlin Multiplatform for some mobile security experiments. If you have good resources on mobile attack surfaces, send them my way.