# Reconnaissance

> Use for information gathering, OSINT, enumeration at start of assessment.

- Author: pf
- Repository: agnusdei1207/pentesting
- Version: 20260207152157
- Stars: 0
- Forks: 0
- Last Updated: 2026-02-07
- Source: https://github.com/agnusdei1207/pentesting
- Web: https://mule.run/skillshub/@@agnusdei1207/pentesting~Reconnaissance:20260207152157

---

---
name: Reconnaissance
description: Use for information gathering, OSINT, enumeration at start of assessment.
version: 1.0.0
---

# Reconnaissance

## Passive

```bash
# DNS
whois target.com
dig target.com ANY

# Subdomains
subfinder -d target.com
curl "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Tech stack
whatweb https://target.com
```

## Active

### Port Scanning
```bash
nmap -sV -sC TARGET              # Version + scripts
nmap -p- --min-rate=1000 TARGET  # All ports fast
nmap -sU --top-ports 100 TARGET  # UDP
```

### Service Enumeration

| Port | Service | Commands |
|------|---------|----------|
| 21 | FTP | `ftp TARGET`, `nmap --script ftp-anon` |
| 22 | SSH | `ssh -v TARGET` |
| 80/443 | HTTP | `gobuster dir`, `nikto` |
| 445 | SMB | `smbclient -L`, `smbmap` |
| 389 | LDAP | `ldapsearch -x -H ldap://TARGET` |
| 161 | SNMP | `snmpwalk -c public` |

### Web Enumeration
```bash
gobuster dir -u http://TARGET -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
gobuster dir -u http://TARGET -w common.txt -x php,txt,bak
ffuf -u http://TARGET/FUZZ -w wordlist.txt
```

## Cloud

```bash
# AWS S3
aws s3 ls s3://target-bucket --no-sign-request

# Azure Blob
https://target.blob.core.windows.net/container
```

## Output

```bash
mkdir -p recon/{dns,ports,web}
nmap -sV -sC -oA recon/ports/nmap TARGET
```