Reconnaissance

For educational purposes only

My early attempts at practicing cybersecurity "in the wild" were frustrating because the most exciting aspects were legally off-limits. While platforms like HackTheBox and TryHackMe are excellent, I struggled to retain the information when simply following a tutorial. I craved a live, unscripted environment where I could build a methodology from the ground up.

I realized my passion lay in the art of discovery, specifically reconnaissance. To pursue this legally, I pivoted entirely to OSINT, building a stack of tools designed to map external threats without active engagement. I began researching and using multiple tools which I will list below and try to provide you with some helpful information on what they do, where to find them, and an example if possible.

---

SOME TOOLS I USE FOR RECON

Initial DNS & Network Commands

• ( host ) example → host example.com Performs simple DNS lookups to convert domain names to IP addresses.

• ( nslookup ) example → nslookup example.com Queries Internet name servers interactively to find IP addresses or specific DNS records.

• ( traceroute ) example → traceroute example.com Maps the path packets take across the network to reach the target.

DNS Enumeration

• ( dnsrecon ) example → dnsrecon -d example.com Checks for Zone Transfers, standard record enumeration, and cache snooping.

• ( dig ) example → dig example.com ANY Interrogates DNS name servers; great for troubleshooting and verifying specific record types.

Web Technology Identification

• ( whatweb ) example → whatweb example.com Identifies websites, recognizing web technologies including CMS, JS libraries, and servers.

• ( wappalyzer ) Usage: Go to website and signup, confirm email, then type target domain into search bar. A browser extension (or API) that uncovers the technologies used on websites.

• ( wafw00f ) example → wafw00f example.com Allows you to identify and fingerprint WAF products protecting a website.

Open Source Intelligence Gathering (OSINT)

• ( whois ) example → whois example.com Retrieves domain registration information, including the registrant, registrar, and dates.

• ( DNSdumpster ) Usage: Visit dnsdumpster.com and search the target domain. Web application to identify DNS records and map the visible attack surface.

• ( theHarvester ) example → theHarvester -d example.com -b all Gathers emails, subdomains, hosts, employee names, and open ports from public search engines.

• ( sublist3r ) example → sublist3r -d example.com Enumerates subdomains using many search engines (like Google, Yahoo, Bing, etc).

---

There are plenty more tools I use, but honestly, I need to wrap this up. It’s taken me a week just to get this far, the #dadlife struggle is real.

I genuinely enjoy recon because it feels like an art form. While no two targets are exactly alike, most share similarities; after a while, you start to recognize patterns that allow you to iterate much faster.

For note-taking, I usually just keep a simple text editor open. I know tools like Obsidian are the industry standard, but the learning curve is steep, and I haven't had the time to master it yet. However, if you are a beginner like me, my biggest piece of advice is to document everything. Your notes serve two purposes: they build a reference library for when you encounter similar issues in the future, and they act as a portfolio to show potential employers or clients what you can do.

Finally, start researching professional reporting templates now. Find a style that works for you. When the time comes to explain your findings to a non-technical business owner, having a structured, readable report is just as important as the recon itself.

That is all I have for now. I hope you enjoyed this and let me know if there is something specific you want me to cover next!