> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/redteam/reconnaissance.md).

# Reconnaissance

## 00. Basic

```bash
https://docs.reconness.com/
https://coggle.it/diagram/XepDvoXedGCjPc1Y/t/enumeration-mindmap
https://www.xmind.net/m/5dypm8/#
```

## 01. Passive Recon

* Manual

```bash
## ------------------| Get information about ip(4/6) address and mail server address.
whois h4rithd.com
host h4rithd.com
nslookup h4rithd.com
traceroute h4rithd.com

## ------------------| Enumarate DNS / NS Information
dnsrecon -d h4rithd.com
dig h4rithd.com
dig h4rithd.com MX             ## List Mail server records  
dig h4rithd.com NS             ## List NameServer records
dig h4rithd.com ANY            ## List all records
dig @8.8.8.8 h4rithd.com ANY   ## Using google dns server

## ------------------| DNS Zone Transfer
dnsrecon -d h4rithd.com -t axfr

## ------------------| Check waf
wafw00f h4rithd.com

## ------------------| Interesting Sites
https://dnsdumpster.com/
https://sitereport.netcraft.com/?url=h4rithd.com

## ------------------| Identify web technology
whatweb h4rithd.com

## ------------------| OSINT on domain
theHarvester -b crtsh,dnsdumpster,duckduckgo,google,hackertarget,linkedin,linkedin_links,twitter,trello -d dialog.com           

## ------------------| Subdomain enumeration
knockpy dialog.lk
sublist3r -d h4rithd.com
fierce --domain h4rithd.com 

## ------------------| Subdomain enumeration from Certificate Transparency
curl -s https://crt.sh/\?q\=h4rithd.com\&output\=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u     
curl -s "https://crt.sh/?q=h4rithd.com&output=json" | python3 -c "
import sys,json
certs=json.load(sys.stdin)
domains=set()
for c in certs:
    for d in c.get('name_value','').split('\n'):
        domains.add(d.strip())
for d in sorted(domains): print(d)
"

## ------------------| HTTP Probing Live Asset Identification
for sub in www uat api shop portal lms omnichannel; do
  code=$(curl -sk --max-time 5 -o /dev/null -w "%{http_code}" "https://$sub.h4rithd.com")
  echo "$sub.h4rithd.com => HTTP $code"
done

## ------------------| SSL Certificate Analysis
curl -sk --max-time 10 "https://h4rithd.com" -v 2>&1 | grep -A5 "Server certificate"
#### Also via Nikto SSL scan
nikto -h h4rithd.com -ssl -nointeractive 2>/dev/null | grep -i "DNS\|SAN\|Subject"

## ------------------| JavaScript Bundle Analysis
#### Extract all JS bundle URLs
curl -sk "https://h4rithd.com" | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"//'
#### Fetch main bundle
curl -sk "https://h4rithd.com/static/js/main.js" | grep -oE 'https?://[a-zA-Z0-9._-]+\.azurewebsites\.net[^"'\'']*'
```

* Automation

```bash
## ------------------| Sn1per
sudo sniper -t h4rithd.com
sudo sniper -t h4rithd.com -m stealth -o -re 

## ------------------| Amass
amass enum -d h4rithd.com -dir output
amass enum -d h4rithd.com -src -ip -brute -dir output ### Active scan
amass db -dir output -list     ### List all workspace
amass viz -dir output -d3      ### Create html report

## ------------------| Recon-ng
recon-ng
marketplace search            ### Search module
marketplace install <Module>  ### Install module
modules search                ### List installed modules
modules load <Module>         ### Load installed modules
options list                  ### List module options
options set SOURCE <domain>   ### Config modules
```