The Art Of Web Reconnaissance: Learn How To Recon Like a Pro

Understand that a domain is a string that resolves to a server IP address. See how domain names act as easy nicknames for hosts like google.com, mapping to their IPs.

learn to find root domains for a target using voxy.com, discover subdomains and domain scope with hooks, and explore api options for expanding domain discovery.

Utilize Amass with a mask to find root domains and subdomains by querying IP ranges, performing domain enumeration from passive sources, and saving results for whois lookups.

Define subdomains as parts of a domain hosting different applications, such as drive.google.com or login.sony.com, and note they may share a server or have separate IPs in scope for reconnaissance.

Learn passive subdomain enumeration with sub finder, using sources like Google to discover subdomains, and explore basic usage and output options.

Configure subfinder by editing the config file to add custom api keys for multiple sources, verify integration, and load subdomains from chosen sources.

Learn to perform subdomain enumeration with amass, focusing on passive enumeration and outputting results with -o and -v, while analyzing MX records and cloudflare signals for potential subdomain takeover risks.

Learn to filter subdomains from a data set using regular expressions and grep, focusing on be practical dot tech and its subdomains.

Configure amass with api keys by editing config.yaml and data sources.yaml, add security trails api key, and verify sources by running amass with the config to enumerate subdomains.

Discover why subdomain brute forcing complements passive enumeration to reveal private subdomains that public sources miss. Use word lists, like checklist, and fuzzing tool f to brute force dns subdomains.

Learn to perform subdomain brute forcing with the f tool, using wordlists and flags like -u and -w, to uncover valid subdomains and handle http to https redirects.

Discover subdomain brute forcing with go-buster for DNS enumeration. Configure targets, wordlists, and resolvers to uncover subdomains like test.sony.com and pro.sony.com, and note when access is denied on specific subdomains.

Learn to perform subdomain brute forcing with amass after passive enumeration. Use a domain, a word list, and verbose output to discover subdomains.

Explore virtual host enumeration, discover internal subdomains and hidden hosts behind a web application, and learn practical techniques like host header testing and Burp Suite workflows.

Combine multiple subdomain enumeration tools, focusing on passive options like ms and sub finder along with grep and sort -u, to deduplicate and consolidate sony.com subdomains for faster reconnaissance.

Filter live subdomains with the https tool to identify web applications, compile and run the code with Golang, and use the -title flag to reveal titles for targeted vulnerability exploration.

Explore subdomain enumeration using permutation techniques with word lists and depth settings, using go tater on Kali Linux to generate diverse subdomains like admin.test.google.com.

Explore subdomain enumeration with permutation using alt DNS, from installation and setup to generating permuted subdomains, resolving candidates, and saving valid results.

Learn how web application firewalls like Cloudflare protect apps and why discovering the origin IP matters in port scanning, revealing the real server behind the shield.

Discover how to identify a server's origin IP address behind Cloudflare using a Census API workflow, including cloning the tool, installing dependencies, configuring API keys, and testing targets.

Learn to locate a server's origin IP address using security trails, review historical IP data, and compare Cloudflare and census.

Identify the origin IP address, then perform port scanning with nmap to reveal open ports and services using flags for os detection, version info, default script, and speed adjustments.

Explore vulnerability scanning with Nmap on specific or top ports like 80, using --script to detect vulnerabilities and interpret results, including potential firewall bypass via FTP filter.

Explore port scanning with naabu, compare its speed and accuracy to nmap, install it, verify with --help, and run scans on subdomains using top ports.

Install essential fuzzing and content discovery tools, verify wordlists and checklists, and prepare for directory enumeration in this lecture on web reconnaissance tool setup.

Learn how to use dirsearch and related search techniques to enumerate website content, customize wordlists, specify extensions, bypass obstacles, and identify interesting endpoints like phpMyAdmin during web reconnaissance.

Learn how to filter out false positives in web reconnaissance using dirsearch by constraining status codes (200, 301, 403, etc.), excluding extensions, and refining searches for useful endpoints.

Learn how to use dirsearch to add multiple status codes by excluding specific responses with --exclude-status or -x, filtering endpoints effectively.

Learn to use dirsearch with custom word lists from checklist, combining word lists with -w and --word-list, and exclude 403 with -x to boost endpoint discovery.

Master active web reconnaissance by using dirsearch with custom headers to access authenticated endpoints, leveraging authorization tokens and cookies, and testing header-based access with Burp Suite.

Learn how to perform recursive content enumeration with Dirsearch by drilling into endpoints like admin, settings, and profile until no further endpoints remain, using the -r recursion option.

Explore content discovery with F to enumerate directories, API endpoints, and parameters using word lists, with custom headers, deep recursion, redirects, and status codes.

Filter out all urls from a json data set using a Python program (f.py) as part of ffuf output filtering, parsing json, and printing the urls from the results.

Learn how to use FFUF with custom headers, including the -H option to add single or multiple headers, and test authenticated endpoints like the admin panel.

Use ffuf for web reconnaissance with advanced filtering: filter and match http status codes with mc and fc, auto calibrate with ac, and refine by size, words, and lines.

Identify hidden endpoints by analyzing web app directory patterns and using the F tool to brute-force endpoint fragments with a word list, headers, and cookies.

Learn to perform content enumeration and pattern-based web reconnaissance using Burp Suite and custom scripts, identifying test and admin endpoints through word lists and response patterns.

Master passive content enumeration to discover endpoints from multiple sources without directly hitting a server, and learn to use go get all URLs and Wayback URLs.

Master passive enumeration with glue to gather all urls, filter by status, strings, and parameters, and archive results to JSON for quick analysis.

Use Wayback URLs for passive content enumeration to extract sub domains, dates, and versions. Save results to text files, filter duplicates, and sort data with curl.

Master active enumeration with katana to crawl a web application and discover endpoints. Learn to use flags like -u, -t, -js, and -0 for targeted depth and output.

Start with a common wordlist to infer technologies, then switch to raft medium or raft large. Use passive enumeration to identify patterns; perform active crawling with katana and custom headers.

Execute subdomain enumeration through reconnaissance to uncover web applications on targets like ABC.com, using SubFinder and httpx to map subdomains, identify technologies, and prioritize vulnerable endpoints.

Filter subdomains and identify web applications, then automate screenshot collection with go witness. Install, configure, and run the tool to generate screenshots for targeted subdomains.

Identify the first target by applying filters for old technologies like asp.net, php, and jsp, and unusual behavior, examining subdomains for an api developer portal behind a static page spin.ab.com.

Master content discovery with Google dorks by crafting precise queries like site:, extension (et), and url to reveal php endpoints and login pages on a target site.

Learn to perform web reconnaissance by using Google Docs to discover endpoints on a live app, uncover registration and login paths, and analyze hidden functionalities for deeper exploration.

Explore hidden functionalities by enumerating endpoints using get all URLs, then validate and compare endpoints behind authentication to uncover advanced options and potential vulnerabilities.

Discover a high risk vulnerability where the reports feature reveals credit card reports containing personal identifiable information, including names and emails, highlighting PII disclosure risks in web reconnaissance.

Identify how exposed pin and order numbers can retrieve other users' invoices, revealing addresses and credit card details, and highlight darknet leakage and social engineering risks in web reconnaissance.

Identify a critical vulnerability by reconnaissance of an order management page; view, edit, and delete order data and notes, gaining full control over orders through sensitive information exposure.

Build your web reconnaissance, ethical hacking, and bug bounty skills by staying updated on the latest trends and methodologies, and keep learning through the B practical tech channel.