Recon Quick Hits — knockpy, ffuf, amass

I wanted a tiny, repeatable snippet for quick reconnaissance. These are the three commands I keep coming back to — one for subdomains, one for endpoint fuzzing, and one for broad enum. Copy/paste, tweak, run, move on.

Only use against targets you own or have permission to test.

1) Subdomain sweep with knockpy

python3 knockpy.py XXX --silent json > /XXX/XXX.json

What I’m doing here

• XXX — replace with the target domain (e.g., example.com).
• --silent — quieter output (good for piping to files).
• json — output format (versions differ; some use --json <file>).
• > /XXX/XXX.json — redirect raw JSON output to a file.

Depending on your knockpy version, you may prefer:

bash Copy

knockpy -d example.com --json /tmp/knockpy-example.json --silent

2) Endpoint fuzzing with ffuf (Swagger wordlist)

ffuf -w /usr/share/seclists/Discovery/Web-Content/swagger.txt      -u https://XXX/FUZZ      -mc 200,204,301,302,307,401,403      -of json -o output.json &&      cat output.json | jq . > fuff-result.json && rm -f output.json

Why these flags

• -w /usr/share/seclists/.../swagger.txt — a wordlist tuned for API/Swagger paths.
• -u https://XXX/FUZZ — target URL; FUZZ is ffuf’s placeholder.
• -mc ... — match HTTP codes that typically indicate “interesting.”
• -of json -o output.json — write machine-friendly results first…
• jq pretty-prints into fuff-result.json, then drops the temp file.

Tip: Add -H 'Authorization: Bearer <token>' or -H 'Host: foo' as needed.
For vhosts, -H 'Host: target.tld' -u http://IP/FUZZ is handy.

3) Broad enumeration with amass

amass enum -d xyz.com -json out.json

Notes

• enum — active enumeration mode.
• -d xyz.com — the root domain to enumerate.
• -json out.json — structured output you can parse later.

For a quicker, passive-only sweep: amass enum -passive -d xyz.com -json out.json

Workflow I usually follow

1. amass to map the space broadly.
2. knockpy as a second opinion / alternative sources.
3. Feed live hosts into ffuf for common API paths and misconfig endpoints.
4. Keep everything as JSON so it’s scriptable later.

One-liners to grep something useful

# Pull URLs from ffuf JSON
jq -r '.results[]?.url' fuff-result.json

# Unique subdomains from amass
jq -r '.[].name' out.json | sort -u

# Filter only 200/401 (auth-guarded) from ffuf
jq -r '.results[] | select(.status_code==200 or .status_code==401) | .url' fuff-result.json

That’s it — small, sharp, and easy to extend.