recon-methodology

name	recon-methodology
description	Comprehensive reconnaissance methodology covering OSINT, subdomain enumeration, technology fingerprinting, DNS reconnaissance, and attack surface mapping. Includes passive and active recon techniques with OPSEC considerations.

Reconnaissance Methodology

Overview

Reconnaissance is the foundation of every successful penetration test. This skill covers passive and active reconnaissance techniques for mapping the attack surface.

Passive Reconnaissance

Domain Intelligence

WHOIS Information:

whois example.com
# Look for: Registrar, creation/expiration dates, nameservers, registrant info

Historical WHOIS:

# View historical registration data
# Tools: whoisxmlapi, viewdns.info

DNS History:

# View historical DNS records
# Tools: securitytrails, viewdns.info, dnshistory.org

Subdomain Enumeration (Passive)

Certificate Transparency:

# crt.sh
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sort -u

# CertSpotter
curl -s "https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true&expand=dns_names" | jq

# Censys
curl -s "https://search.censys.io/api/v2/certificates/search?q=example.com"

Search Engines:

# Google dorks
site:example.com -www
site:*.example.com

# Bing API
# DuckDuckGo
# Shodan
# Censys
# Fofa
# BinaryEdge

Public Datasets:

# Archive.org
curl -s "http://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=json&fl=original&collapse=urlkey"

# Common Crawl
# VirusTotal API
# URLScan

Passive DNS:

# PassiveTotal
# Farsight DNSDB
# SecurityTrails passive DNS

Subdomain Aggregation Services:

# Sublist3r API sources
theharvester -d example.com -b all

# Amass (passive mode)
amass enum -passive -d example.com -o amass.txt

Email Enumeration

Email Harvesting:

theharvester -d example.com -b google,linkedin,bing,yahoo

Email Patterns:

# Hunter.io
curl -s "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=KEY"

# Phonebook.cz

Technology Stack Detection

BuiltWith:

curl -s "https://api.builtwith.com/v19/api.json?KEY=xxx&LOOKUP=example.com"

Wappalyzer:

# Using wappalyzer CLI
wappalyzer https://example.com

Web Server Fingerprinting:

curl -sI https://example.com | grep -i "server\|powered\|via"

Source Code Repositories

GitHub Recon:

# Search for sensitive files
github-search "org:targetorg password"
github-search "org:targetorg api_key"
github-search "org:targetorg secret"
github-search "org:targetorg token"
github-search "org:targetorg config"

# Search for specific extensions
github-search "extension:pem target"
github-search "extension:sql target"
github-search "extension:env target"

GitLab/GitBucket:

# Similar searches on other platforms

Cloud Resources

AWS S3 Buckets:

# Using bucket finder tools
# Using wordlists: company_name, target_env, etc.

Azure Storage:

# Check for .blob.core.windows.net

GCP Storage:

# Check for storage.googleapis.com

Social Media

OSINT Tools:

# Sherlock
sherlock username

# Social Analyzer
# Instagram OSINT
# LinkedIn enumeration

Employee Information

LinkedIn:

# linkedin2username tool
python linkedin2username.py -c "company" -o output.txt

Employee Patterns:

• Email formats: [e-mail]
• Username patterns
• Department identification

Active Reconnaissance

DNS Enumeration

DNS Record Types:

# A records
dig A example.com

# AAAA records
dig AAAA example.com

# MX records
dig MX example.com

# NS records
dig NS example.com

# TXT records
dig TXT example.com

# SOA records
dig SOA example.com

# SPF records
dig TXT example.com | grep -i spf

# DMARC records
dig TXT _dmarc.example.com

# DKIM records
dig TXT selector._domainkey.example.com

Zone Transfer:

# Try zone transfer
dig axfr @ns1.example.com example.com

# Using dnsrecon
dnsrecon -d example.com -t axfr

# Using dnsenum
dnsenum example.com

DNS Brute Force:

# Using dnsrecon with wordlist
dnsrecon -d example.com -D /usr/share/wordlists/dnsrecon/subdomains-top1mil-5000.txt -t brt

# Using gobuster
gobuster dns -d example.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Subdomain Brute Force (Active)

Tools:

# Amass (active + passive)
amass enum -active -d example.com -o amass_active.txt

# Subfinder
subfinder -d example.com -o subfinder.txt

# Assetfinder
assetfinder --subs-only example.com > assetfinder.txt

# Findomain
findomain -t example.com -o findomain.txt

# Chaos
chaos -d example.com -o chaos.txt

# ShuffleDNS
shuffledns -d example.com -w wordlist.txt -r resolvers.txt

# PureDNS
puredns bruteforce wordlist.txt example.com -r resolvers.txt

Wordlists:

• /usr/share/wordlists/seclists/Discovery/DNS/
• Custom wordlists based on target
• Permutations: dev, staging, admin, api, etc.

Host Discovery

Ping Sweeps:

# Using nmap
nmap -sn 192.168.1.0/24

# Using masscan
masscan 192.168.1.0/24 -p0 --rate 1000

# Using fping
fping -a -g 192.168.1.0/24 2>/dev/null

Port Scanning

Nmap Scans:

# Quick scan
nmap -sV -sC -oN nmap_quick.txt target

# Full port scan
nmap -p- -sV -oN nmap_full.txt target

# UDP scan
nmap -sU --top-ports 100 -oN nmap_udp.txt target

# Aggressive scan
nmap -A -T4 -oN nmap_aggressive.txt target

# Stealth scan
nmap -sS -Pn -T2 --randomize-hosts target

# Script scan
nmap --script vuln -oN nmap_vuln.txt target

Masscan:

# Fast port scanning
masscan 0.0.0.0/0 -p0-65535 --rate 10000 -oJ output.json

# With exclusions
masscan 0.0.0.0/0 -p0-65535 --excludefile exclude.txt

Rustscan:

# Ultra-fast scanning
rustscan -a target -- -A

Unicornscan:

# Alternative scanner
unicornscan -mT target/24:1-65535

Service Enumeration

Banner Grabbing:

# Netcat
nc -v target port

# Telnet
telnet target port

# Nmap
nmap -sV --version-intensity 9 target

HTTP Service Detection:

# Whatweb
whatweb -a 3 -v target

# Wappalyzer
wappalyzer target

# BuiltWith
# WebTech
webtech -u https://target

Web Path Discovery

Directory Brute Force:

# ffuf
ffuf -u https://target/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302,403

# Gobuster
gobuster dir -u https://target -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# Dirsearch
python3 dirsearch.py -u https://target -e php,asp,aspx,jsp,html,js,bak,txt

# Feroxbuster
feroxbuster -u https://target -w /usr/share/wordlists/dirb/common.txt

# Dirb
dirb https://target /usr/share/wordlists/dirb/common.txt

# Cewl + gobuster (custom wordlist)
cewl -d 2 -m 5 -w custom.txt https://target
gobuster dir -u https://target -w custom.txt

Virtual Host Discovery:

# ffuf for vhosts
ffuf -u https://target -H "Host: FUZZ.target.com" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

API Discovery

Common API Paths:

/api/
/api/v1/
/api/v2/
/api/v3/
/rest/
/graphql
/swagger.json
/api-docs/
/openapi.json

API Fuzzing:

# Using ffuf
ffuf -u https://target/api/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/api-endpoints.txt

Content Analysis

Web Application Mapping

Crawling:

# Katana
katana -u https://target -d 5 -o katana.txt

# Hakrawler
echo "https://target" | hakrawler -d 3

# Gospider
gospider -s "https://target" -d 3 -o output

# Waybackurls
echo "target.com" | waybackurls > wayback.txt

# Gau
gau target.com > gau.txt

JavaScript Analysis:

# Extract URLs from JS
linkfinder -i https://target/script.js -o cli

# SecretFinder
python3 SecretFinder.py -i https://target/script.js

# truffleHog for secrets
trufflehog git https://github.com/target/repo

Screenshot Enumeration

Tools:

# EyeWitness
eyewitness --web -f urls.txt -d eyewitness

# Aquatone
cat hosts.txt | aquatone -ports xlarge

# gowitness
gowitness file -f urls.txt --threads 4

# webscreenshot
python webscreenshot.py -i urls.txt

Attack Surface Mapping

Asset Inventory

Create Asset Map:

┌─────────────────────────────────────────────────────────────┐
│ Target: example.com                                         │
├─────────────────────────────────────────────────────────────┤
│ Subdomains:                                                │
│   - www.example.com (185.199.108.153) - Web                │
│   - api.example.com (104.16.100.52) - API                │
│   - mail.example.com - Mail                               │
│   - vpn.example.com - VPN                                 │
│                                                            │
│ IPs:                                                       │
│   - 185.199.108.153                                        │
│   - 104.16.100.52                                         │
│                                                            │
│ Services:                                                  │
│   - TCP/80: Nginx 1.18                                    │
│   - TCP/443: Nginx 1.18 (SSL)                             │
│   - TCP/22: OpenSSH 8.2                                   │
│                                                            │
│ Technologies:                                              │
│   - WordPress 5.8                                         │
│   - PHP 7.4                                               │
│   - MySQL (backend)                                       │
│                                                            │
│ Cloud:                                                     │
│   - AWS (based on headers)                                │
│   - S3 bucket: example-bucket.s3.amazonaws.com            │
└─────────────────────────────────────────────────────────────┘

Prioritization Matrix

Risk-Based Prioritization:

Priority 1 (Critical):
- Internet-facing admin panels
- Outdated services with known CVEs
- Default credentials
- Exposed sensitive data

Priority 2 (High):
- Web applications with user input
- API endpoints
- Subdomains with interesting names
- Legacy systems

Priority 3 (Medium):
- Standard web services
- Common ports
- Information disclosure

Priority 4 (Low):
- Services requiring auth
- Limited functionality
- Known good configurations

OPSEC Considerations

Stealth Techniques

Rate Limiting:

# Slow scans
nmap -T2 --max-retries 1 target

# Delay between requests
ffuf -rate 10 -u https://target/FUZZ -w wordlist.txt

Source IP Rotation:

# Using proxy chains
proxychains nmap -sT target

# Using VPN
# Using VPS rotation

User-Agent Rotation:

# Using random user agents
ffuf -H "User-Agent: Mozilla/5.0..." -u https://target/FUZZ -w wordlist.txt

Timing Randomization:

# Random delays between requests
# Working hours only
# Distributed scanning

Automation

Recon Pipeline

#!/bin/bash
# recon.sh - Full reconnaissance automation

TARGET=$1
OUTPUT_DIR="recon_$TARGET_$(date +%Y%m%d)"
mkdir -p $OUTPUT_DIR

echo "[+] Starting recon for $TARGET"

# Passive recon
echo "[+] Passive DNS"
amass enum -passive -d $TARGET -o $OUTPUT_DIR/amass_passive.txt

# Active DNS
echo "[+] Active DNS"
amass enum -active -d $TARGET -o $OUTPUT_DIR/amass_active.txt

# Subdomain aggregation
echo "[+] Aggregating subdomains"
cat $OUTPUT_DIR/*.txt | sort -u > $OUTPUT_DIR/all_subdomains.txt

# Probe for alive hosts
echo "[+] Probing for alive hosts"
cat $OUTPUT_DIR/all_subdomains.txt | httprobe > $OUTPUT_DIR/alive.txt

# Port scanning
echo "[+] Port scanning"
nmap -iL $OUTPUT_DIR/alive.txt -sV -sC -oN $OUTPUT_DIR/nmap.txt

# Screenshot
echo "[+] Taking screenshots"
cat $OUTPUT_DIR/alive.txt | aquatone -out $OUTPUT_DIR/aquatone

echo "[+] Recon complete. Output in $OUTPUT_DIR"

Tools Summary

Category	Tools
Subdomain Enum	amass, subfinder, assetfinder, chaos, findomain
DNS	dig, dnsrecon, dnsenum, fierce
Port Scanning	nmap, masscan, rustscan, unicornscan
Web Crawling	katana, hakrawler, gospider, waybackurls
Directory Brute	ffuf, gobuster, dirsearch, feroxbuster
Screenshots	eyewitness, aquatone, gowitness
OSINT	theharvester, sherlock, linkedin2username
Secret Finding	truffleHog, gitLeaks, SecretFinder
Tech Detection	whatweb, wappalyzer, webtech

References

• OSINT Framework
• Bug Bounty Hunter's Methodology
• The Art of Subdomain Enumeration
• Recon.ng Documentation
• Amass Documentation