This post contains my notes on Jason Haddix’s presentation on adversarial recon from the Red Team and Bug Bounty Conference. Recon is a subset of OSINT. We’re after Apex domains, subdomains, IP addresses, services, contextual business and tech intel. For every subdomain or apex domain you find, you