Reconnaissance

Reconnaissance (recon) is the preliminary survey to collect information about a target.

Active reconnaissance#

Active reconnaissance is a method of information gathering in which the tools used actually send out probes to the target network or systems in order to elicit responses that are then used to determine the posture of the network or system. These probes can use various protocols and multiple levels of aggressiveness, typically based on what is being scanned and when. For example, you might be scanning a device such as a printer that does not have a very robust TCP/IP stack or network hardware. By sending active probes, you might crash such a device. Most modern devices do not have this problem; however, it is possible, so when doing active scanning, you should be conscious of this and adjust your scanner settings accordingly.

Common active activities include:

Sending packets to discover live hosts (e.g., ICMP pings, ARP requests).
Port scanning or service enumeration (Nmap, masscan).
Interacting with web applications or APIs (fuzzing endpoints, directory brute-forcing).
Social engineering attempts (phishing, vishing, pretexting phone calls).
Physical approaches (tailgating, posing as a vendor).

Common active reconnaissance methods include the following:

Host enumeration
Network enumeration
User enumeration
Group enumeration
Network share enumeration
Web page enumeration
Application enumeration
Service enumeration
Packet crafting

Tools:

Nmap / zenmap
enum4linux

Passive reconnaissance#

Passive reconnaissance is a method of information gathering in which the tools do not interact directly with the target device or network. There are multiple methods of passive reconnaissance. Some involve using third-party databases to gather information. Others also use tools in such a way that they will not be detected by the target. These tools, in particular, work by simply listening to the traffic on the network and using intelligence to deduce information about the device communication on the network. This approach is much less invasive on a network, and it is highly unlikely for this type of reconnaissance to crash a system such as a printer. Because it does not produce any traffic, it is also unlikely to be detected and does not raise any flags on the network that it is surveying. Another scenario in which a passive scanner would come in handy would be for a penetration tester who needs to perform analysis on a production network that cannot be disrupted. The passive reconnaissance technique that you use depends on the type of information that you wish to obtain. One of the most important aspects of learning about penetration testing is developing a good methodology that will help you select the appropriate tools and technologies to use during the engagement.

Common passive activities include:

Querying public DNS records from open resolvers (A, MX, TXT, etc.).
Searching certificate transparency logs (e.g., crt.sh) for subdomains and issued certificates.
Reviewing job postings on LinkedIn or company career pages for tech stack hints.
Reading public news, press releases, or leaked documents on paste sites.
Checking exposed devices via search engines like Shodan or Censys.
Scanning public GitHub repositories for hardcoded credentials or configuration files.

Common passive reconnaissance tools and methods include the following:

Domain enumeration
Packet inspection
Open-source intelligence :: OSINT
Recon-ng
Eavesdropping

Reconnaissance tools#

whois #

nslookup#

nslookup (Name Server Lookup) used to query DNS records
Usage:

nslookup DOMAIN_NAME performs a simple lookup using your default resolver.
nslookup -type=TYPE DOMAIN_NAME [SERVER] specifies a record type and an optional DNS server.
Common DNS record types: A, AAAA, CNAME, MX, SOA, TXT or use any to get all records

dig#

dig (historically a backronym for “Domain Information Groper”) is the modern alternative to nslookup. It provides cleaner output, displays TTL values by default (showing how long records are cached), and is more reliable for complex queries and scripting.
Usage:

dig [@SERVER] DOMAIN_NAME [TYPE]

Zone transfer

dig axfr @[ip] [domain]

Reverse DNS (rDNS) lookups use the IP address to query for the host names of the services that resolve to that address.

Enter the dig command using the -x option to retrieve the hostname and record type of the DNS server with ip. dig -x [ip]

host#

The Host utility is a function in Linux that performs lookups to convert IP addresses to host names. we can use this utility to find another host on the network.
Host can also be used to perform a quick IP address lookup for a known hostname.
host [ip] or host [domain]

Certificate Transparency (CT) Logs#

The most effective passive subdomain discovery method today is Certificate Transparency logs
Certificate Transparency is a public logging framework (mandatory since approximately 2015) that records every SSL/TLS certificate issued by participating Certificate Authorities. Each certificate contains a Subject Alternative Name (SAN) field listing the domains and subdomains it covers. By searching these logs, you can discover subdomains without sending any traffic to the target.

https://crt.sh ↗
To use crt.sh, visit https://crt.sh and search for %.example.com. The % wildcard matches any subdomain. The results will list every certificate issued for subdomains of example.com, often revealing 10 to 100 times more subdomains than DNSDumpster alone.
crt.sh is fully passive, operates in real time, and has no rate limits for basic use.
https://crt.name ↗

More Domain Info#

DNSDumpster ↗
- It aggregates public DNS data from sources such as search engine caches, zone transfer databases, and certificate records. It does not perform brute-force enumeration, which means it remains fully passive. The results include subdomains and hosts, resolved IPs with geolocation, MX, TXT, and CNAME records, and visual maps showing the relationships between these.
dnsrecon
theharvester
- theHarvester is a tool that can be used to enumerate DNS information about a given hostname or IP address. It can query several data sources, including Baidu, Google, LinkedIn, public Pretty Good Privacy (PGP) servers, Twitter, vhost, Virus Total, ThreatCrowd, CRT.SH, Netcraft, and Yahoo.
- theHarvester -d [domain.com] -b [source|google]
Subfinder - to find subdomains - subfinder -d website.com
sublist3r
- apt install sublist3r
- for subdomains : sublist3r -d site.com
- slow
Amass - github.com/OWASP/Amass
- to find subdomains
- faster/ preferred
- amass enum -passive -d domain.com
httpx helps you to get different list of data from a website
- subfinder -d example.com | httpx -title -ports 443,8443
waybacktool
- https://github.com/tomnomnom/waybackurls ↗
- cd ~/go/bins
- cat [domains.txt] | ./waybackurls > [domain.urls]
waymore
waybackurl - https://github.com/tomnomnom/waybackurls ↗
getallurl
httprobe
- github.com/tomnomnom/httprobe
- check if the pages in the wayback tool are valid
- `cat [domain.urls] | httprobe
- use httprobe -t 1000 to reduce time
Maltego
Maltego, which gathers information from public records, is one of the most popular tools for passive reconnaissance. It supports numerous third-party integrations. There are several versions of Maltego, including a community edition (which is free) and several commercial Maltego client and server options. You can download and obtain more information about Maltego from https://www.paterva.com ↗. Maltego can be used to find information about companies, individuals, gangs, educational institutions, political movement groups, religious groups, and so on. Maltego organizes query entities within the Entity Palette, and the search options are called “transforms.” Figure 10-6 shows a screenshot of the search results for a Person entity (in this case a search against this book’s coauthor Omar Santos). The results are hierarchical in nature, and you can perform additional queries/searches on the results (entities).