Can I Replace AI With My Recon Methodology?

# Overview In this talk, the speaker explores integrating artificial intelligence into their bug bounty recon methodology to streamline lead generation. Emphasizing that their typical vulnerability hunting relies on manual testing and standard web proxy tools rather than automated exploit-finding AI, the speaker sets out to solve a common recon bottleneck: sifting through large sets of asset data and tracking targets. By connecting Claude to Google Sheets via Zapier's Model Context Protocol (MCP) and using Neo to generate an asset-evaluation framework, the workflow automatically evaluates HTTPX output, prioritizes interesting targets, and populates a collaborative Google Sheet.

# Key Topics - **Recon and Lead Generation**: Offloading repetitive recon tasks—such as grepping through DNS records, page titles, and status codes—to AI to discover promising attack surfaces. - **MCP Integration with Zapier**: Configuring a Zapier MCP server (`mcp.zapier.com`) connected to Google Sheets and integrating it with Claude to give the model tool-use access for reading, writing, and updating spreadsheets. - **Framework Design with Neo**: Using Neo to build a comprehensive scoring and tiering framework that assesses HTTPX recon data based on path naming conventions, redirects, and detected technologies. - **Asset Prioritization Strategy**: Categorizing targets into prioritized tiers (admin panels, DevOps tools, APIs, dev/staging environments, and auth portals) while filtering down lower-value marketing pages.

# Technical Details 1. **Zapier MCP Configuration**: An MCP server labeled `recon mcp` is set up on Zapier, granting access to 28 tools including Google Sheets actions. The resulting URL is connected directly into Claude. 2. **Framework Generation via Neo**: The speaker iteratively prompted Neo to construct a decision framework using HTTPX fields (titles, content length, technologies, redirect locations). The model generated a tiered prioritization system: - *Tier 1*: High-value targets such as admin panels, internal infrastructure, CI/CD pipelines, DevOps tooling, issue trackers (Jira), Jenkins, and source code artifacts. - *Tier 2*: APIs, development sites, authentication portals, monitoring services, and databases. - *Tier 3*: Login portals, file upload endpoints, CDNs, email systems, support ticketing, and payment/billing pages. - *Tier 4*: Low-priority marketing sites, blogs, news, and press portals. - *Technology & Redirect Analysis*: Evaluating IIS, Tomcat, WordPress, as well as employee SSO redirects (Okta, OneLogin, SAML, Windows ADFS). 3. **Prompt and Project Execution**: The instructions were structured as `prompt.md` and added into a Claude project named `recon mcp` with instructions to score assets and write findings directly into Google Sheets. 4. **Target Execution**: The methodology was tested against a subset of Equifax vulnerability disclosure program (VDP) recon data. The speaker extracted roughly 400 unique 403-status assets (`cat results | sort -u | grep` for 403 and Equifax) and fed them to Claude. Claude analyzed the input and created a Google Sheet listing scored assets (identifying 11 critical, 7 high, and 1 medium asset), highlighting 15 non-production environments, 9 APIs, 10 Java applications, and 2 ServiceNow instances alongside suggested next steps.

# Takeaways The experiment demonstrates that AI paired with tool-calling capabilities like MCP can effectively act as a lead-generation assistant for bug bounty hunters. While AI can occasionally misunderstand rules across repeated runs, feeding structured HTTPX output into a rigorously prompted model reliably parses, scores, and exports high-priority targets into structured formats like Google Sheets, significantly reducing manual data-parsing overhead.