recon.sh

#!/usr/bin/env zsh

rm ~/bugbounty -rf
mkdir ~/bugbounty
cd ~/bugbounty
curl -O "https://raw.githubusercontent.com/projectdiscovery/public-bugbounty-programs/master/chaos-bugbounty-list.json"
cat chaos-bugbounty-list.json | grep '"name"' | awk '{$1=$1};1' | sed 's/"name": "//g' | sed 's/"name":"//g' | sed 's/",//g' | while read folder; do mkdir -p $folder -v; done
for (( i=0; i < $(cat chaos-bugbounty-list.json | jq -r .programs | jq length); i++ ))
do
   cat chaos-bugbounty-list.json | jq --arg i "$i" -r ".programs[($i | tonumber)].domains | .[]" > "$(cat chaos-bugbounty-list.json | jq --arg i "$i" -r '.programs[($i | tonumber)].name')/assets.txt" && echo -n "."
done

for BBP in $(ls ~/bugbounty); do
    cd ~/bugbounty/$BBP
    subfinder -dL assets.txt -o subdomains.txt

    while read TARGET; do
        echo "Finding technology for $TARGET"
        HTTP_TARGET=$(echo "$TARGET" | httpx -silent | xargs)

        if [ -z "$HTTP_TARGET" ]
        then
            echo "Target not active"
        else
            wappalyzer "$HTTP_TARGET" | jq > "$(echo $HTTP_TARGET | sed -e 's/[^[:alnum:]]/_/g').tech.txt"
        fi  
    done < subdomains.txt
done

cd ~
zip bugbounty.zip ~/bugbounty -r