Recon automation pipeline

When it applies

You track one or more wildcard programs and want discovery to run repeatably (and on a schedule), surfacing only new assets/findings instead of re-reviewing everything.

Why it works

Recon is a directed flow: roots → subdomains → resolve → live → ports → nuclei. Wiring the ProjectDiscovery tools together (each reads/writes lines) makes it composable, and diffing against last run (anew) turns it into continuous monitoring that alerts on change.

Method

1. Pipeline (each stage feeds the next):

   subfinder -dL roots.txt -all -silent \
     | dnsx -silent -a -resp-only \
     | httpx -silent -sc -title -tech-detect \
     | tee live.txt \
     | nuclei -silent -severity low,medium,high,critical

2. Diff for "only new": pipe each stage through anew subs.txt / anew live.txt so reruns emit only newly-seen lines — the basis of continuous monitoring.
3. Notify: pipe results to notify (Slack/Discord/Telegram) so new hosts/findings alert you.
4. Schedule with cron/systemd-timer/GitHub Actions; persist state files per program so runs resume.
5. Keep templates current: nuclei -update-templates before each run.

Gotchas

• Stay in scope: feed only in-scope roots, filter out-of-scope hosts before scanning.
• Respect rate limits (-rl, -c) and program automation rules — don't hammer.
• De-dupe wildcard DNS (dnsx wildcard filtering) or you'll alert on noise forever.

Verify success

A rerun surfaces only newly-appeared assets/findings and notifies you — hands-off continuous coverage.

References

ProjectDiscovery pipeline docs; TomNomNom anew; nuclei templates.