Practical Ethical Hacking and Penetration Testing
Advanced Reconnaissance Techniques
Advanced Reconnaissance
You already know how to find a target's IP address or registration details. Now, we move beyond the basics into structured Open Source Intelligence, or OSINT. The goal is to build a detailed map of a target's digital world—their technology, their people, and their online presence—all without directly touching their servers. This is the art of stealthy information gathering, a critical skill for any ethical hacker.
Effective reconnaissance is about knowing your target better than they know themselves. The more you uncover passively, the more effective your active engagement will be.
Advanced OSINT isn't just a list of domains; it's about connecting the dots. It’s discovering a forgotten development server through a public certificate log, or finding an engineer's personal GitHub repository that accidentally contains company code. This phase provides the blueprints for a successful penetration test.
Automating the Hunt
Manually sifting through public records is slow and inefficient. To operate at scale, we use frameworks that automate OSINT gathering. Two powerful tools for this are Recon-ng and Maltego.
Recon-ng
noun
A modular reconnaissance framework written in Python. It's like a Swiss Army knife for OSINT, with different modules to query various public data sources, from search engines to social media.
Recon-ng operates from a command-line interface. You create a workspace for your target, add a domain, and then load modules to find related information like hosts, contacts, or leaked credentials. Each piece of data is stored in a database, ready for the next step of your assessment.
# Example workflow in Recon-ng
# Start Recon-ng
recon-ng
# Create a workspace for the target
[recon-ng][default] > workspaces create example_com
# Add the target domain
[recon-ng][example_com] > db insert domains
Domain: example.com
# Use a module to find hosts (e.g., via Google)
[recon-ng][example_com] > modules load recon/domains-hosts/google_site_web
[recon-ng][example_com][google_site_web] > run
# Show the hosts found
[recon-ng][example_com][google_site_web] > show hosts
While Recon-ng is great for automated data collection, Maltego excels at visualizing it. Maltego takes a single piece of information, called an entity (like a domain name), and runs "transforms" to find related entities. It then plots these relationships on a graph. This visual map can reveal unexpected connections, like a marketing site hosted on the same IP block as a sensitive internal application.
Uncovering Digital Infrastructure
Mapping a target's infrastructure is like casing a building before a heist. You need to know all the entrances, what kind of locks are on the doors, and what technology is used inside. But you have to do it from across the street.
Information gathering, or reconnaissance, is the foundation of a successful penetration test.
One of the first steps is DNS enumeration. This process aims to discover all subdomains associated with a primary domain (e.g., finding dev.example.com, vpn.example.com, and test.example.com). While brute-forcing common subdomain names is one method, a far stealthier technique involves public records.
Certificate Transparency (CT) logs are a goldmine for this. Whenever a company gets an SSL/TLS certificate for a domain, a public record is created. By searching these logs, you can find a list of every subdomain a company has secured, often revealing internal or forgotten systems. Websites like crt.sh provide an easy interface to search these logs.
After identifying domains and subdomains, the next step is to figure out the technology they're running. Tools like BuiltWith and Wappalyzer do this passively. They analyze the HTML, JavaScript, and HTTP headers of a website to identify its technology stack. You can discover the content management system (CMS), web server software, analytics tools, and JavaScript libraries in use, all without sending a single suspicious packet to the server. This information helps you select the right exploits later on.
| Technique | Tool/Source | Information Gained |
|---|---|---|
| Subdomain Discovery | Certificate Transparency Logs | Hostnames, internal systems |
| Technology Stack | BuiltWith, Wappalyzer | Web server, CMS, frameworks |
| Leaked Credentials | Data Breach Dumps | Usernames, email patterns, passwords |
Finally, no reconnaissance is complete without searching for leaked credentials. Over the years, countless services have been breached, and their user data has been dumped online. Attackers and ethical hackers alike sift through these dumps looking for email addresses associated with the target domain. Finding even one leaked password can provide a foothold, as people often reuse passwords across different services.
What is the primary goal of structured OSINT in the context of ethical hacking?
An analyst wants to discover subdomains for a target company, such as dev.example.com and vpn.example.com, using a stealthy method that relies on public records of SSL/TLS certificates. Which technique should they use?
Thorough, stealthy reconnaissance sets the stage for every subsequent phase of an ethical hack. The more you know before you act, the greater your chances of success.