Wondering what bash scripting for bug bounty actually looks like once you get past the theory? There’s a specific moment every bug hunter remembers: the first time they checked a subdomain by hand, then had to check another one, then another, then twenty more after that. Somewhere around subdomain number fifteen, a quiet thought shows up: there has to be a faster way than this. There is, and it takes about ten lines of Bash.