Reconnaissance
gathering information to plan future adversary operation.
00. Basic
https://docs.reconness.com/
https://coggle.it/diagram/XepDvoXedGCjPc1Y/t/enumeration-mindmap
https://www.xmind.net/m/5dypm8/#01. Passive Recon
## ------------------| Get information about ip(4/6) address and mail server address.
whois h4rithd.com
host h4rithd.com
nslookup h4rithd.com
traceroute h4rithd.com
## ------------------| Enumarate DNS / NS Information
dnsrecon -d h4rithd.com
dig h4rithd.com
dig h4rithd.com MX ## List Mail server records
dig h4rithd.com NS ## List NameServer records
dig h4rithd.com ANY ## List all records
dig @8.8.8.8 h4rithd.com ANY ## Using google dns server
## ------------------| DNS Zone Transfer
dnsrecon -d h4rithd.com -t axfr
## ------------------| Check waf
wafw00f h4rithd.com
## ------------------| Interesting Sites
https://dnsdumpster.com/
https://sitereport.netcraft.com/?url=h4rithd.com
## ------------------| Identify web technology
whatweb h4rithd.com
## ------------------| OSINT on domain
theHarvester -b crtsh,dnsdumpster,duckduckgo,google,hackertarget,linkedin,linkedin_links,twitter,trello -d dialog.com
## ------------------| Subdomain enumeration
knockpy dialog.lk
sublist3r -d h4rithd.com
fierce --domain h4rithd.com
## ------------------| Subdomain enumeration from Certificate Transparency
curl -s https://crt.sh/\?q\=h4rithd.com\&output\=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u
curl -s "https://crt.sh/?q=h4rithd.com&output=json" | python3 -c "
import sys,json
certs=json.load(sys.stdin)
domains=set()
for c in certs:
for d in c.get('name_value','').split('\n'):
domains.add(d.strip())
for d in sorted(domains): print(d)
"
## ------------------| HTTP Probing Live Asset Identification
for sub in www uat api shop portal lms omnichannel; do
code=$(curl -sk --max-time 5 -o /dev/null -w "%{http_code}" "https://$sub.h4rithd.com")
echo "$sub.h4rithd.com => HTTP $code"
done
## ------------------| SSL Certificate Analysis
curl -sk --max-time 10 "https://h4rithd.com" -v 2>&1 | grep -A5 "Server certificate"
#### Also via Nikto SSL scan
nikto -h h4rithd.com -ssl -nointeractive 2>/dev/null | grep -i "DNS\|SAN\|Subject"
## ------------------| JavaScript Bundle Analysis
#### Extract all JS bundle URLs
curl -sk "https://h4rithd.com" | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"//'
#### Fetch main bundle
curl -sk "https://h4rithd.com/static/js/main.js" | grep -oE 'https?://[a-zA-Z0-9._-]+\.azurewebsites\.net[^"'\'']*'Last updated