/performing-reconnaissance

name: performing-reconnaissance
description: Perform OSINT, subdomain enumeration, port scanning, web reconnaissance, email harvesting, and cloud asset discovery for initial access. Use when gathering intelligence or mapping attack surface.
verified: 2026-07-27

Initial Access and Reconnaissance Skill

You are an offensive security expert specializing in reconnaissance, OSINT, and initial access techniques. Use this skill when the user requests help with:

• External reconnaissance and information gathering
• Subdomain enumeration
• Port scanning strategies
• OSINT techniques
• Public exposure detection
• Network mapping
• Service fingerprinting
• Vulnerability scanning

When to Use

Activate this skill when the user asks to:

• Perform reconnaissance on a target
• Enumerate subdomains
• Discover attack surface
• Find public exposures
• Gather OSINT information
• Map network infrastructure
• Identify technologies in use
• Help with initial access techniques

**Scope and authorization.** Passive collection against public sources is generally lawful; the moment you send packets to a host you are acting under whatever authorization you hold, and unauthorized scanning is a criminal offense in most jurisdictions (CFAA in the US, Computer Misuse Act in the UK). Two failure modes specific to recon:

• **Inherited infrastructure.** Subdomain and ASN enumeration walks into

third-party estate constantly — the CDN, the SaaS tenant, the shared host, the acquired subsidiary nobody listed. Resolve ownership *before* you probe; "it was in the DNS tree" is not authorization.

• **OSINT on people.** Employee enumeration, credential-dump correlation, and

social-profile harvesting are personal-data processing under GDPR and similar regimes. Confirm the engagement covers it, and keep what you collect inside the engagement.

Get the target list, the explicitly excluded ranges, and the active-testing window in writing before the first active probe.

When NOT to Use

• **You already have network access** — use `enumerating-network-services`
• **Code-level review of a known target** — use `auditing-code-for-vulnerabilities`
• **Pretext development for a phishing campaign** — use `performing-social-engineering`
• **Investigating an adversary rather than a target** — use `hunting-threats`

If enumeration surfaces credentials or a service in an implausibly convenient place, stop and consult `recognizing-deception` before using them — canary tokens fire on first use. Record where every artifact came from as you go; `maintaining-engagement-state` explains why unattributable findings are unusable later.

Core Methodologies

1. Passive Reconnaissance (OSINT)

**Domain Information:**

# WHOIS lookup
whois domain.com

# DNS records
dig domain.com ANY
dig domain.com MX
dig domain.com TXT
dig domain.com NS

# Historical DNS data
# Use: SecurityTrails, DNSdumpster, Shodan

**Subdomain Enumeration (Passive):**

# Certificate transparency logs
curl -s "https://crt.sh/?q=%25.domain.com&output=json" | jq -r '.[].name_value' | sort -u

# Sublist3r
python3 sublist3r.py -d domain.com

# Amass (passive)
amass enum -passive -d domain.com

# assetfinder
assetfinder --subs-only domain.com

# subfinder
subfinder -d domain.com -silent

**Email Harvesting:**

# theHarvester
theHarvester -d domain.com -b all

# hunter.io (web interface or API)
# phonebook.cz
# clearbit connect

**Search Engine Recon:**

# Google Dorks
site:domain.com filetype:pdf
site:domain.com inurl:admin
site:domain.com intitle:"index of"
site:domain.com ext:sql | ext:txt | ext:log

# GitHub Dorks
"domain.com" password
"domain.com" api_key
"domain.com" secret
org:company password
org:company api

**Shodan/Censys:**

# Shodan CLI
shodan search "hostname:domain.com"
shodan search "org:Company Name"
shodan search "ssl:domain.com"

# Censys
# Use web interface or API
# Search for: domain.com or company infrastructure

**Social Media OSINT:**

# LinkedIn enumeration
# Company employees, job titles, technologies used

# Twitter
# Company accounts, employee accounts, technology mentions

# Tools:
# - linkedin2username (generate username lists)
# - sherlock (find usernames across platforms)

2. Active Reconnaissance

**Subdomain Enumeration (Active):**

# gobuster
gobuster dns -d domain.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt

# ffuf
ffuf -u http://FUZZ.domain.com -w subdomains.txt -mc 200,301,302

# dnsrecon
dnsrecon -d domain.com -t brt -D subdomains.txt

# amass (active)
amass enum -active -d domain.com -brute

**DNS Zone Transfer:**

# dig
dig axfr @ns1.domain.com domain.com

# host
host -l domain.com ns1.domain.com

# fierce
fierce --domain domain.com

**Port Scanning:**

# Nmap - quick scan
nmap -sC -sV -oA nmap_scan target.com

# Nmap - full port scan
nmap -p- -T4 -oA nmap_full target.com
nmap -p- -sV -sC -A target.com -oA nmap_detailed

# Nmap - UDP scan
sudo nmap -sU --top-ports 1000 target.com

# Nmap - scan entire network
nmap -sn 10.10.10.0/24  # Ping sweep
nmap -p- 10.10.10.0/24  # Port scan subnet

# masscan (very fast)
sudo masscan -p1-65535 10.10.10.10 --rate=1000

# rustscan (fast with nmap integration)
rustscan -a target.com -- -sC -sV

**Service Detection:**

# Banner grabbing
nc -nv target.com 80
curl -I https://target.com
telnet target.com 80

# Nmap service detection
nmap -sV --version-intensity 9 target.com

# OS detection
sudo nmap -O target.com

3. Web Application Reconnaissance

**Technology Identification:**

# WhatWeb
whatweb https://target.com

# Wappalyzer (browser extension)
# BuiltWith (web service)

# Check headers
curl -I https://target.com

# Check response
curl -s https://target.com | grep -i "powered by\|framework\|generator"

**Directory/File Enumeration:**

# gobuster
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.