Reconnaissance
Intelligence gathering is the foundation of any successful penetration test. The more you know about your target, the more effective your attacks will be.
🔍 Why Reconnaissance Matters
💡 Pro Tip: Spend 30-40% of your engagement time on reconnaissance - thorough recon dramatically increases success rates in later phases.
📚 Reconnaissance Guides
Explore in-depth guides for each reconnaissance technique. Each guide includes tools, techniques, examples, and practical exercises.
Passive Reconnaissance
OSINTOSINT fundamentals, WHOIS analysis, DNS enumeration, certificate transparency logs, Google dorking, Shodan/Censys, and leaked credential discovery.
Subdomain Discovery
EnumerationPassive sources (CT logs, SecurityTrails), DNS brute-forcing, permutation discovery, automation pipelines, and subdomain takeover detection.
Active Reconnaissance
ActiveTechnology fingerprinting, web crawling, JavaScript analysis, screenshot capture, service detection, and automated enumeration pipelines.
Subdomain Takeover
CriticalIdentifying dangling DNS records, exploiting unclaimed cloud resources, and claiming subdomains via GitHub Pages, S3, Azure, and other services.
🛠️ Essential Reconnaissance Tools
Reconnaissance Workflow
Normalize + Enrich
Dedupe assets, resolve DNS, tag stack, confirm ownership, and rank value.
Target Profile
Turn raw findings into scoped hosts, apps, users, tech, and assumptions.
✅ Quick Checklist
Ensure you've completed reconnaissance across all categories:
- ☐ WHOIS analysis
- ☐ DNS enumeration
- ☐ CT log subdomains
- ☐ Google dorking
- ☐ Passive sources
- ☐ DNS brute-forcing
- ☐ Permutation scanning
- ☐ Takeover detection
- ☐ Tech fingerprinting
- ☐ Web crawling
- ☐ JS analysis
- ☐ Screenshot capture
Next Steps