recon-phase

name	recon-phase
tags	["recon"]
description	Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.

Passive Reconnaissance Checklist

Work through each item. Mark completed in your state updates. Skip items not applicable to the target type.

DNS Enumeration

dig <domain> ANY +noall +answer
dig <domain> MX +short
dig <domain> NS +short
dig <domain> TXT +short
host -t AXFR <domain> <nameserver>   # zone transfer attempt

WHOIS

whois <domain>
whois <ip>

Subdomain Discovery

subfinder -d <domain> -silent -o subdomains.txt
amass enum -passive -d <domain> -o amass_subs.txt
# Merge and deduplicate
cat subdomains.txt amass_subs.txt | sort -u > all_subs.txt

Certificate Transparency

curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u

Reverse DNS

# For each discovered IP
for ip in $(cat ips.txt); do host "$ip"; done

IP Geolocation & ASN

whois -h whois.radb.net -- "-i origin $(whois <ip> | grep -i origin | awk '{print $2}')"
curl -s "https://ipinfo.io/<ip>/json" | jq .

Google Dorking

Search patterns:

• site:<domain> filetype:pdf|doc|xls|conf|sql|log
• site:<domain> inurl:admin|login|wp-admin|phpmyadmin
• site:<domain> intitle:"index of"
• site:<domain> ext:env|cfg|ini|bak

Shodan / Censys

shodan host <ip>
shodan search "hostname:<domain>"

Web Archive

curl -s "https://web.archive.org/cdx/search/cdx?url=*.<domain>&output=json&fl=original&collapse=urlkey" | jq -r '.[][]' | sort -u

Technology Detection

whatweb <url> -v
curl -sI <url>   # server headers, X-Powered-By

Phase Completion Criteria

Move to ENUMERATION when:

• All target domains/IPs identified
• Subdomains enumerated
• DNS records collected
• WHOIS data recorded
• Technology stack identified where possible