Reconnaissance & The Enumeration Workflow

What is reconnaissance?

Reconnaissance (recon) is the very first phase of any security assessment: gathering as much information about a target as possible, before you touch it, scan it, or attempt anything. Think of it like a burglar casing a house for a week before ever trying a door: watching who comes and goes, noting which windows are left open, reading the mail left in the box. None of that requires breaking in, and by the time they act, they already know exactly where to go.

In security work, recon answers questions like: What domains and subdomains does this company own? What software do they run, and which versions? Who works there, and what have they accidentally leaked online? Every later stage, scanning, exploitation, reporting, is only as good as the recon that fed it. Skip it, and you are guessing; do it properly, and the target's own weaknesses point the way.

Passive vs active recon, with real scenarios

Real scenario 1, passive: You are scoping a bug bounty target the night before you're allowed to start. You can legally browse Shodan, read certificate logs, and Google-dork the company's domain right now, none of it touches their infrastructure, so there's nothing to be "in scope" for yet.

Real scenario 2, active: Testing begins tomorrow at 9am per the client's agreement. Only then can you ping their servers, traceroute their network, or open a telnet connection, actions that generate real packets a defender might notice.

The rule professionals follow: exhaust passive first, it's free, silent, and often reveals more than people expect, then go active only for what passive couldn't answer.

Passive recon toolkit

whois, who owns the domain

Every registered domain has public registration details: who registered it, when, which registrar, and which nameservers it uses.

whois acme.com

Real scenario: A phishing domain acme-support.com shows up in a report. whois on it reveals it was registered three days ago through a privacy-shielded registrar, a classic tell for a throwaway phishing site, versus the real acme.com, registered eight years ago by the actual company.

nslookup & dig, resolving DNS by hand

Both look up DNS records for a hostname (which IP does this name point to?).

nslookup acme.com
dig acme.com
dig MX acme.com     # which servers handle their email

dig is the more detailed, script-friendly tool; nslookup is the older, simpler one available on almost every OS by default, useful when you're on a locked-down machine with nothing else installed.

dnsdumpster, a free visual DNS map

dnsdumpster.com is a free web-based tool that maps a domain's DNS records, subdomains, and hosting providers visually, no installation, no account, just enter a domain in the browser. It's often the fastest way to get a first impression of a target's footprint before running any local tools.

Shodan & Censys, search engines for devices

Regular search engines index webpages. Shodan (shodan.io) and Censys (censys.io) index devices, they continuously scan the entire internet and let you search by IP, open port, banner, or even physical location.

org:"Acme Corp"           # Shodan: every device Shodan has seen belonging to Acme
port:3389 country:"US"    # Shodan: exposed Windows Remote Desktop in the US

Real scenario: A pentester searches Shodan for the client's org name and finds a forgotten industrial control panel exposed directly to the internet on port 502, an asset the client's own IT team didn't know was reachable. That single passive search, no scan of their own, found the biggest risk in the whole engagement.

Google dorking, weaponising search operators

Search engines have already crawled and indexed huge amounts of a target's exposed content. Dorking uses advanced search operators to filter that index down to exactly what you want.

site:acme.com filetype:pdf              # PDFs published on their site
site:acme.com inurl:admin               # pages with "admin" in the URL
site:acme.com intitle:"index of"         # exposed directory listings
"acme.com" -site:acme.com filetype:xls   # spreadsheets mentioning them, hosted elsewhere

The community-maintained Google Hacking Database (GHDB) catalogues thousands of these dorks for finding exposed logins, cameras, backups, and more.

(This is only a taste. Search Engine Dorking is a whole lesson on the operators, cross-engine and GitHub dorking, and the GHDB, and Search Engines, Crawlers & robots.txt explains how crawlers build the index a dork queries.)

GitHub dorking, leaked secrets in public code

Developers accidentally commit passwords, API keys, and internal hostnames to public repositories constantly. GitHub's own search, plus dedicated tools, can find them:

org:acme "password"              # on github.com/search: search Acme's public repos for the word "password"
github-subdomains -d acme.com -t <token>   # find subdomains mentioned in public code

Real scenario: A developer at a fintech startup pushes a .env.example file that still contains a real (not example) database password, copy-pasted by mistake. A GitHub dork for the company's org name plus DB_PASSWORD surfaces it within seconds of the commit going public.

(Certificate Transparency logs, crt.sh, subfinder, and amass are covered in depth in the Subdomain Enumeration lesson, they are passive too, just specialised for finding subdomains.)

Active recon toolkit

Browser Developer Tools, free and built into every browser

Press F12 (or right-click, Inspect) on any page. DevTools shows the raw HTML, every network request the page makes, cookies, and any JavaScript, often revealing API endpoints, hidden form fields, or comments developers forgot to remove. It's technically "active" only in the mild sense that you loaded the page normally, exactly what any visitor does.

Wappalyzer, instant technology fingerprinting

Wappalyzer is a browser extension (and API) that identifies the technology stack behind a website the moment you visit it, CMS, JavaScript framework, analytics tools, server software, payment processors, all without running a single scan.

Real scenario: Before choosing an exploit, a tester installs Wappalyzer and instantly sees the target runs WordPress 5.4 with the Contact Form 7 plugin, no manual fingerprinting needed, saving the active whatweb scan for later confirmation.

ping, is it even alive?

ping acme.com

Sends ICMP echo requests to check if a host responds at all. Simple, but it's the fastest first check, and no reply doesn't always mean "down", firewalls often block ICMP while the host is very much up.

traceroute, mapping the path

traceroute acme.com

Shows every router ("hop") a packet passes through on its way to the target, useful for understanding network topology, spotting load balancers or CDNs, and figuring out roughly where a target's infrastructure is hosted.

telnet, manually speaking to a service

telnet acme.com 80
GET / HTTP/1.1
Host: acme.com

telnet opens a raw TCP connection you can type into by hand. Point it at port 80 and you can hand-type an HTTP request; point it at port 22 or 25 and the service often announces itself immediately (a banner) the moment you connect, free version information with zero tooling.

netcat (nc), the Swiss-army knife

nc acme.com 443           # connect to a port manually, like telnet but for any protocol
nc -lvnp 4444             # listen on a port, e.g. to catch a reverse shell

netcat reads and writes raw data over TCP/UDP. It can grab banners, transfer files, or act as a listener, one small tool with more uses than almost anything else in this list.

(masscan, nmap, nikto, gobuster, and ffuf, the heavier active scanning and fuzzing tools, get full lessons of their own: Port Scanning with nmap, Service Enumeration, and Directory & Content Discovery. This lesson only covers the lighter, everyday active tools.)

The enumeration funnel

Once recon fundamentals click, every tool in this week fits one map: start as broad as possible and narrow, stage by stage, down to specific weaknesses.

1. Scope & OSINT , whois, Shodan/Censys, Google/GitHub dorks, dnsdumpster (this lesson).
2. Subdomains , expand the attack surface: subfinder, amass, crt.sh (its own lesson).
3. Live hosts , filter with dnsx (resolves) and httpx (live web servers), then gowitness to screenshot for a quick eyeball.
4. Ports & services , nmap (thorough) or rustscan/masscan (fast), then enumerate each service (its own lesson).
5. Content, params & JS , ffuf/gobuster for hidden paths (its own lesson), katana/gau to crawl, arjun for hidden parameters (deeper web recon).
6. Vulnerabilities , nuclei templates, wpscan, searchsploit.

Tools that pipe together

The Unix pipe (from the shell-basics lesson) is what makes recon fast, one tool's output becomes the next tool's input:

subfinder -d target.com -silent | httpx -silent | nuclei -severity high
#   find names        ->    keep live      ->   scan for high-sev bugs

Try it (terminal)

1. whois acme.com , read a domain's registration record.
2. nslookup acme.com and dig acme.com , resolve it two different ways.
3. traceroute acme.com , see the path to the host.
4. telnet acme.com 80 then type GET / HTTP/1.1 , hand-craft an HTTP request.
5. nc acme.com 443 , grab a quick TCP connection with netcat.
6. subfinder -d acme.com then httpx -l subs.txt , the start of the active funnel.

Stay in scope

Passive recon (whois, Shodan, dorking) touches only third parties and is broadly safe to run anytime. The moment you go active, ping, traceroute, telnet, and everything after, only do it against assets you are explicitly authorised to test.

Why this matters

Beginners jump straight to exploiting the first thing they see. Professionals map the whole funnel first, because the easy win is almost always something recon surfaces long before any exploit is written, a leaked key on GitHub, a device exposed on Shodan, a banner that names the exact vulnerable version.