--- title: "Recon & Discovery · VORNAC Research" description: "The recon catalog end-to-end: passive vs. active modes, subdomain discovery across CT logs and DNS, web-stack fingerprinting, and port-to-service mapping." url: https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/recon-and-discovery --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Recon & Discovery Featured · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Recon & Discovery. The recon catalog end-to-end: passive vs. active modes, subdomain discovery across CT logs and DNS, web-stack fingerprinting, and port-to-service mapping. ## Recon modes - **Passive.** No packets to the target. Sources: `crt.sh`, Shodan, Censys, FOFA, BGP toolkit, GitHub code search, Wayback Machine. Required mode for stealth engagements and competitive intel work. - **Semi-passive.** Traffic that looks like normal user behavior: a single HTTP GET, a single DNS lookup. Tolerated under most engagement scopes without explicit scan authorization. - **Active.** Port scans, directory fuzzing, wordlist-driven enumeration. Requires written scope authorization and ideally a maintenance window. ## Subdomain discovery — full pipeline 1. **CT logs.** `crt.sh?q=%25.target.com`, `subfinder` with all sources enabled. Catches anything ever issued a public cert. 2. **DNS bruteforce.** `shuffledns` or `puredns` with the SecLists `n0kovo_subdomains` wordlist against a custom resolver list to avoid rate-limit. Handle wildcards explicitly. 3. **ASN walk.** Lookup AS number via `whois` or `asnlookup`; sweep the entire ASN range; reverse-DNS to find neighbors not in the public zone. 4. **JS scraping.** `katana` + `subjs` to extract URLs from JavaScript bundles. Frontends frequently hardcode internal-only API hostnames. 5. **Archive mining.** `waybackurls`, `gau`. Historic hosts that no longer resolve still indicate naming conventions. ## Web fingerprinting signals - **Headers.** `Server`, `X-Powered-By`, `Set-Cookie` names (`PHPSESSID`, `JSESSIONID`, `ASP.NET_SessionId`), CSP directives. - **Favicon hash.** MD5 of `/favicon.ico` → Shodan `http.favicon.hash:`. Identifies products by their default icon even when banners are stripped. - **Error pages.** 404, 500, and parser-error pages have product-specific wording that survives header scrubbing. - **Behavioral probe.** Request `/.env`, `/server-status`, `/actuator/health`, `/api/v1`. Response codes and bodies fingerprint the stack. ## Port → first-look service - **21 FTP.** Anonymous read first, banner second. Check writable directories. - **22 SSH.** Banner reveals OS family; `ssh-audit` for KEX/MAC posture; userlist enum via timing on old OpenSSH. - **445 SMB.** `crackmapexec smb` for null-session, signing, OS version, share enum. - **389/636 LDAP.** Anonymous bind first; root DSE for naming context; userPrincipalName enumeration. - **1433 MSSQL.** `mssqlclient.py -windows-auth` with sprayed creds; `xp_cmdshell` if sysadmin. - **3389 RDP.** `nmap --script rdp-enum-encryption` for NLA posture; never brute-force without lockout policy confirmed. - **5985/5986 WinRM.** `evil-winrm` with sprayed creds. If admin, you have a shell with no AV-touching binary. - **6379 Redis.** Unauthenticated by default. `config set dir /var/spool/cron/` + crontab write for RCE. - **27017 MongoDB.** Unauthenticated in default Docker images. `mongosh` + show dbs. **Rule of thumb**The cheapest find of the engagement is usually in the recon phase. Spend the time. A subdomain nobody on the security team knows exists is worth more than three exotic exploits against a hardened main app. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Featured Engagement phases ReconOSINTFingerprinting Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) From reference to evidence ## Run this against your own environment.