• Cheat Sheets
    • Programming
      • Bash
      • docker-compose
      • Dockerfile
      • Markdown
      • MySQL
      • PHP
      • PowerShell
      • Python
    • Tools
      • AMSITrigger
      • aria2
      • bettercap
      • binwalk
      • chisel
      • ciphey
      • docker
      • docker-compose
      • Empire
      • exiftool
      • foremost
      • h8mail
      • hashcat
      • hcxtools
      • hugo
      • Hydra
      • Metasploit
      • mitm6
      • msfvenom
      • Name-That-Hash
      • ncat
      • Nmap
      • ntlmrelayx
      • openssl
        • s_client
      • PSDNSDumpsterAPI
      • psexec
      • Rdesktop
      • responder
      • Search-That-Hash
      • searchsploit
      • smb
      • steghide
      • sublist3r
      • theHarvester
      • ThreatCheck
      • usbrip
      • whatweb
    • Unix
      • apt
      • awk
      • base64
      • bzip2
      • chmod
      • cron
      • curl
      • cut
      • dig
      • file
      • find
      • ftp
      • gpg
      • grep
      • gzip gunzip zcat
      • md5sum
      • ntp
      • rev
      • scp
      • sed
      • showmount
      • sort
      • strings
      • tar
      • tmux
      • touch
      • tr
      • uniq
      • watch
      • wc
      • xxd
    • Windows
      • NET
      • runas
  • Guides
    • printnightmare
    • Ubuntu VPS
      • 00. Introduction
      • 01. Adding users
      • 02. Managing of packages
      • 03. File editor: vim
      • 04. UFW
      • 05. SSH Keys
      • 06. Setup sshd
      • 07. Unattended Upgrades
      • 08. Fail2ban
      • 09. Logwatch
      • 10. Sysctl Optimization
  • Notes
    • Courses
      • Blackhat Python
      • Breaching The Cloud
      • Python4N00bs
      • The Cyber Mentor
    • CTFs
      • Graficom Spoorzoeker
        • Challanges
        • Solutions
      • HTB
        • Bashed
        • Blue
        • Devel
        • Grandpa
        • Granny
        • Jerry
        • Lame
        • Legacy
        • Netmon
        • Nibbles
        • Optimum
      • OverTheWire
        • Bandit
        • Natasa
      • underthewire
        • century
        • cyborg
      • VulnHub
        • Fristileaks
        • Kioptrix
          • Level 1
          • Level 2
          • Level 3
          • Level 4
        • Pwnlab
        • Stapler
        • Vulnix
      • Vulnserver
        • TRUN
    • Hacking Methodology
      • External
        • Misconfigured Cloud Assets
        • Phising
        • Post Exploit
          • cloud-provider-web-servers
          • rdp
          • Remote UAC
        • recon
          • Certificate Transparency Logs
          • Credential Gathering
          • DNS Recon
          • E-Mail Gathering
          • Google Dorking
          • Identify Technologies
          • public key disclosure
          • Shodan
      • General
        • AV Bypass
          • Malware Test VM
        • Buffer Overflow
        • Discover Open Ports
        • encrypted password protected pdf
        • encrypted password protected zip
        • password cracking
          • rules
          • wordlists
        • Password Spraying
        • post compromise recon
        • priv esc
        • Redis
        • shell escaping
        • SQL Injection
        • Web
      • Internal
        • Active Directory
          • credentialaccess
          • IPv6 DNS Takeover
          • LLMNR and NBT-NS
          • SMB Relay
          • WPAD
        • postexploit
          • steal access tokens
    • Networking
      • OSI Model
        • Layer 1
        • Layer 2
        • Layer 3
        • Layer 4
        • Layer 5
        • Layer 6
        • Layer 7
      • TCP/IP Model
    • Random Things
      • backscatter
      • dash in file name
      • ssh sha256 to public key
    • Private

More

  • Github
  • Blog
  • Twitter
  • LinkedIn

Built with Hugo Learn and Hugo

> Notes > Hacking Methodology > External > recon
  • Recon
External

Recon

    Certificate Transparency Logs

    Your certs are leaking.

    Credential Gathering

    The art of Credential Gathering.

    DNS Recon

    DNS Recon, if you don't know where stuff is its gonna get hard to hack it.

    E-Mail Gathering

    If you know e-mail addresses you know naming conventions and possible even passwords.

    Google Dorking

    Ask the almight Google Machine. It. Knowns. All.

    Identify Technologies

    Who, What and Where.

    public key disclosure

    Sharing is caring, but this may be a but to much.

    Shodan

    And you though google knew a lot!