The Big Picture: Recon, Scanning & Enumeration
This week has a lot of tools in it, whois, nmap, subfinder, gobuster, nikto, and more. Before you meet any of them, take two minutes to see the map. Every tool in this week fits into one simple flow, and once you can see that flow, the rest of the week just clicks into place.
Why gather information first?
Imagine a thief who wants to rob a house. A smart one doesn't just walk up and kick the door. First they watch: which lights are on, when the family leaves, whether there's a dog, which window has a broken latch. By the time they act, they already know exactly where to go and what to avoid.
Security testing works the same way. The stage where you learn everything you can about a target, before you try anything, is called information gathering. Skip it and you're guessing in the dark. Do it well and the target's own weak spots point you straight to them.
Information gathering is not one action, it's three steps, done in order. Beginners often use the three names as if they mean the same thing. They don't.
The three steps, in plain English
1. Reconnaissance , "what exists?"
You're building a list of everything the target owns: their domains and subdomains, IP ranges, email addresses, the technologies they use, even employee names. Most of this comes from third parties (search engines, public records, certificate logs), so the target never even knows you looked.
Example: you discover the company
acme.comalso runsdev.acme.com,mail.acme.com, and a forgottenold-portal.acme.com.
2. Scanning , "what is reachable?"
Now you have a list of hosts. Scanning checks which of them are actually alive and which doors (ports) are open. A machine might have 65,535 possible ports; scanning quickly tells you the handful that are open and listening, and roughly what's behind each.
Example: you scan
dev.acme.comand find port 22 (SSH), port 80 (a website), and port 3306 (a database) are open.
3. Enumeration , "what exactly is running?"
Scanning told you a door is open; enumeration is looking closely through it. For each open service you dig out the specifics: the exact software and version, usernames, shared folders, hidden pages, configuration mistakes, the concrete details that tell you how to attack.
Example: that website on port 80 turns out to be WordPress 5.4 with an outdated plugin and a login page at
/wp-admin.
The whole flow at a glance
| Step | The question it answers | A few of its tools |
|---|---|---|
| Reconnaissance | What exists? Who owns it? | whois, crt.sh, subfinder, Shodan |
| Scanning | What's reachable and switched on? | nmap, rustscan, masscan |
| Enumeration | What exactly is running, in detail? | nikto, enum4linux, ffuf, gobuster |
One easy way to remember it: recon widens (find everything), scanning narrows (find what's live), enumeration deepens (find the details). Broad, then reachable, then detailed.
How this week is laid out
Each lesson that follows is one part of this flow, in order:
- This lesson , the map you're reading now.
- The Enumeration Workflow , the same flow in more depth, plus passive vs active recon and the everyday tools.
- Subdomain Enumeration , the recon step: finding every subdomain a target owns.
- Port Scanning with nmap , the scanning step: finding open ports and services.
- Service Enumeration , looking closely at each open service.
- Wordlists , the ammunition for guessing hidden names and passwords.
- Directory & Content Discovery , finding hidden pages and files on a web server.
- Deeper Web Recon , crawling, parameters, and screenshots at scale.
You don't need to memorise any commands yet. Just hold onto the flow: recon, then scan, then enumerate. Every tool you meet this week is doing one of those three jobs.
Why this matters
The order is the whole point. You can't scan hosts you haven't found, and you can't enumerate a service you haven't scanned. Beginners who jump straight to the exciting tool waste hours poking at the wrong thing. Follow the flow and each step hands the next one exactly what it needs.