Reconnaissance in Ethical Hacking

What is Reconnaissance?

Reconnaissance, also known as Information Gathering or Footprinting, is the first phase of ethical hacking. It involves collecting as much information as possible about a target system, network, or organization before launching an actual attack.

Types of Reconnaissance

1. Passive Reconnaissance

• Definition: Collecting information without interacting directly with the target system.
• Objective: Stay undetected.
• Sources:
  • WHOIS records
  • DNS info
  • Social media
  • Job postings
  • Public documents (PDFs, DOCs with metadata)
• Tools:
  • whois
  • nslookup
  • theHarvester
  • Google Dorking

2. Active Reconnaissance

• Definition: Direct interaction with the target (e.g., pinging, port scanning).
• Objective: Gather detailed technical data.
• Risk: Can trigger alarms (IDS/IPS).
• Examples:
  • Port scanning
  • OS fingerprinting
  • Service enumeration
• Tools:
  • Nmap
  • Netcat
  • Nikto
  • Telnet

Key Reconnaissance Objectives

• Identify domain names and subdomains
• Find IP address ranges
• Enumerate open ports
• Discover services running on target
• Gather employee names, emails, passwords
• Learn about the organization’s structure and technology stack

Common Reconnaissance Tools

Real-World Footprinting Techniques

DNS Footprinting

• Use dig, nslookup, or dnsenum to find:
  • Subdomains
  • Mail servers
  • Zone transfer vulnerabilities

Employee Footprinting

• Tools like theHarvester or LinkedIn scraping
• Collect:
  • Email addresses
  • Names/titles for spear-phishing
  • Internal tech info from resumes

Metadata Analysis

• Download publicly available PDFs or Word docs
• Use exiftool to extract:
  • Username of author
  • System paths
  • Software used

Company Tech Stack Discovery

• Use Wappalyzer, BuiltWith, or browser extensions
• Detect:
  • Web servers (Apache, Nginx)
  • CMS (WordPress, Joomla)
  • Programming languages and plugins

Hidden Recon Tip No One Tells You

• Check Job Postings & GitHub Repos
  • Job listings often reveal:
    • Internal tools
    • Tech stacks (e.g., “Looking for a Python/Django developer”)
    • Cloud usage (e.g., “AWS experience required”)
  • GitHub leaks:
    • API keys
    • Internal documentation
    • Developer emails and commit logs
• Why it's important: This info can lead to precise targeted attacks and gives you a hacker’s edge that automated scanners miss.

Type of Risk Description