Advanced-Recon Course

Learn to perform recon by gathering data on IPs, web addresses, and subdomains, then enumerate URLs, directories, and APIs using amass, subfinder, and assetfinder.

Explore recon as a data-gathering phase to map IP addresses, web addresses, subdomains, directories, and APIs, using tools like juju, http, probe, subfinder, masscan, and assetfinder to prepare for testing.

Learn to think like a hacker during recon, identify sensitive files and directories, vulnerable ports, and API patterns using osint, code review, and tools like Nmap, Postman, and Burp Suite.

Enumerate JavaScript in the page and the DOM using dev tools and Burp Suite, identify endpoints and tokens, and organize findings into directories and logic for bug hunting.

Learn how cross-origin policies and security headers govern access, examine the access-control-origin header and the content security policy, and enumerate subdomains and endpoints to map the web attack surface.

Learn a practical reconnaissance methodology for bug bounties, starting with subdomain discovery using sub finder and asset finder, then consolidating results with anew.

Explore online sources for recon using Google dorks, subdomain filtering, Census data, certificates, Shodan, and BuiltWith to enumerate targets, map services, and assess scope ethically.

This lecture demonstrates using the Get All URLs tool to collect domain URLs from public crawlers. It shows filtering with httpx and GFE to surface reliable, actionable data.

Learn practical recon using amass, sub finder, and asset finder for subdomain enumeration, then perform active recon with crawler and http probe to collect urls and JavaScript files.

Leverage nmap for reconnaissance and exploitation by using scripts, scanning ports (tcp and udp), pinging alive hosts, and saving open ports and vulnerable service findings to a file.