New The 2026 Continuous Validation Methodology Paper is now available. Read the paper →
Featured · 1 Offensive Tradecraft

Recon & Discovery.

The recon catalog end-to-end: passive vs. active modes, subdomain discovery across CT logs and DNS, web-stack fingerprinting, and port-to-service mapping.

Recon modes

  • Passive. No packets to the target. Sources: crt.sh, Shodan, Censys, FOFA, BGP toolkit, GitHub code search, Wayback Machine. Required mode for stealth engagements and competitive intel work.
  • Semi-passive. Traffic that looks like normal user behavior: a single HTTP GET, a single DNS lookup. Tolerated under most engagement scopes without explicit scan authorization.
  • Active. Port scans, directory fuzzing, wordlist-driven enumeration. Requires written scope authorization and ideally a maintenance window.

Subdomain discovery — full pipeline

  1. CT logs. crt.sh?q=%25.target.com, subfinder with all sources enabled. Catches anything ever issued a public cert.
  2. DNS bruteforce. shuffledns or puredns with the SecLists n0kovo_subdomains wordlist against a custom resolver list to avoid rate-limit. Handle wildcards explicitly.
  3. ASN walk. Lookup AS number via whois or asnlookup; sweep the entire ASN range; reverse-DNS to find neighbors not in the public zone.
  4. JS scraping. katana + subjs to extract URLs from JavaScript bundles. Frontends frequently hardcode internal-only API hostnames.
  5. Archive mining. waybackurls, gau. Historic hosts that no longer resolve still indicate naming conventions.

Web fingerprinting signals

  • Headers. Server, X-Powered-By, Set-Cookie names (PHPSESSID, JSESSIONID, ASP.NET_SessionId), CSP directives.
  • Favicon hash. MD5 of /favicon.ico → Shodan http.favicon.hash:. Identifies products by their default icon even when banners are stripped.
  • Error pages. 404, 500, and parser-error pages have product-specific wording that survives header scrubbing.
  • Behavioral probe. Request /.env, /server-status, /actuator/health, /api/v1. Response codes and bodies fingerprint the stack.

Port → first-look service

  • 21 FTP. Anonymous read first, banner second. Check writable directories.
  • 22 SSH. Banner reveals OS family; ssh-audit for KEX/MAC posture; userlist enum via timing on old OpenSSH.
  • 445 SMB. crackmapexec smb for null-session, signing, OS version, share enum.
  • 389/636 LDAP. Anonymous bind first; root DSE for naming context; userPrincipalName enumeration.
  • 1433 MSSQL. mssqlclient.py -windows-auth with sprayed creds; xp_cmdshell if sysadmin.
  • 3389 RDP. nmap --script rdp-enum-encryption for NLA posture; never brute-force without lockout policy confirmed.
  • 5985/5986 WinRM. evil-winrm with sprayed creds. If admin, you have a shell with no AV-touching binary.
  • 6379 Redis. Unauthenticated by default. config set dir /var/spool/cron/ + crontab write for RCE.
  • 27017 MongoDB. Unauthenticated in default Docker images. mongosh + show dbs.
Rule of thumbThe cheapest find of the engagement is usually in the recon phase. Spend the time. A subdomain nobody on the security team knows exists is worth more than three exotic exploits against a hardened main app.

Related notes in this domain

From reference to evidence

Run this against your own environment.