CompTIA PenTest+ / Ethical Hacking Certification Series

Professional Reference Guide — GitHub Edition

Covers: Passive Reconnaissance · OSINT · DNS · Social Media · Cryptographic Analysis · Shodan

Table of Contents

3.0 Introduction

Module Overview: Information Gathering and Vulnerability Scanning

Module Objective: Perform information gathering and vulnerability scanning activities at a professional, senior-level standard.

Before a single exploit is launched, before a single payload is crafted, every professional penetration tester invests significant time in a discipline that separates competent practitioners from exceptional ones: information gathering. The reconnaissance phase is the intelligence foundation upon which the entire attack strategy is built. The quality of your reconnaissance directly determines the quality of your attack.

Why This Module is the Most Critical in the Entire Penetration Testing Process

Consider the following reality: a skilled penetration tester with 10 hours of thorough reconnaissance and 2 hours of exploitation will consistently outperform a tester with 1 hour of reconnaissance and 11 hours of exploitation. This is because:

  1. Attack surface knowledge — You cannot attack what you do not know exists
  2. Targeted exploitation — Knowing specific versions, technologies, and configurations enables precise attack selection
  3. Stealth — Passive reconnaissance leaves zero traces in target logs
  4. Social engineering precision — Detailed personnel and organizational intelligence enables highly credible pretexts
  5. Scope awareness — Thorough OSINT reveals assets the client may not even know they have

The Reconnaissance-Attack Continuum 

PASSIVE RECON → ACTIVE RECON → SCANNING → ENUMERATION → EXPLOITATION → POST-EXPLOITATION
     (This Module Section 3.1)  (Section 3.2)  (Sections 3.3/3.4)

Enter fullscreen mode Exit fullscreen mode

Passive Reconnaissance is the first and most foundational phase. It involves gathering intelligence about a target using only publicly available information sources, without making any direct contact with the target's systems. The target never knows you are collecting this information.

Active Reconnaissance follows and involves directly interacting with target systems — sending probes, queries, and packets — to enumerate live systems, open ports, and services.

Vulnerability Scanning then uses the intelligence gathered in both recon phases to identify specific security weaknesses in enumerated systems.

Module Topics at a Glance

Section Topic Objective
3.1 Performing Passive Reconnaissance Collect intelligence without touching target systems
3.2 Performing Active Reconnaissance Directly probe target systems to enumerate infrastructure
3.3 Understanding the Art of Performing Vulnerability Scans Conduct structured, methodical vulnerability scanning
3.4 Understanding How to Analyze Vulnerability Scan Results Interpret, prioritize, and act on scan findings

3.1 Performing Passive Reconnaissance

3.1.1 Overview

Passive reconnaissance is the discipline of collecting as much intelligence as possible about a target organization using only publicly available information — information that exists in the open and can be accessed without the target's knowledge.

The term "passive" is critical: during this phase, you generate zero network traffic to the target. No pings. No port scans. No HTTP requests to the target's web server. Every data point is gathered from third-party sources, public databases, archived data, and open web resources.

Why Passive Reconnaissance Matters at the Senior Level

Junior penetration testers often treat reconnaissance as a checklist to complete before getting to the "real work" of exploitation. Senior penetration testers understand that reconnaissance is the work. The penetration testing firm Offensive Security, authors of Kali Linux and creators of the OSCP certification, teach that a penetration tester should spend at least 30-40% of total engagement time on reconnaissance.

The professional reasons:

1. Legal protection: Passive recon is never illegal. Accessing public information carries zero criminal risk, while premature active scanning of the wrong IP address is a CFAA violation.

2. Attack precision: Knowing that a target runs Apache Tomcat 9.0.41 on a specific IP enables you to immediately cross-reference known CVEs. Without this knowledge, you are scanning blindly.

3. Organizational intelligence: Passive recon reveals the human attack surface — executives, IT staff, vendors, technologies in use — enabling social engineering attacks that technical controls cannot stop.

4. Shadow IT discovery: Passive recon routinely reveals subdomains, applications, and cloud assets that the client's IT team does not know exist. These unmanaged assets are frequently the easiest entry points.

5. Timeline intelligence: Web archives reveal what technologies a target used in the past, sometimes exposing legacy systems still in use.

3.1.2 Active Reconnaissance vs. Passive Reconnaissance

Understanding the precise boundary between passive and active reconnaissance is both a technical and a legal necessity.

Passive Reconnaissance — Defined

Passive reconnaissance collects information from sources that are:

  • Publicly indexed and accessible to anyone
  • Third-party resources (not the target's own infrastructure)
  • Archived or cached versions of target information
  • Volunteered information (press releases, job listings, social media)

The defining test: "Did my action generate any network traffic or log entries on the target's systems?" If no — it is passive.

Examples of passive reconnaissance activities:

  • Looking up DNS records using a third-party resolver
  • Searching LinkedIn for employees of the target organization
  • Examining cached versions of the target's website via Google Cache or Wayback Machine
  • Reading the target's press releases and annual reports
  • Searching Shodan for the target's IP ranges
  • Examining SSL certificate transparency logs
  • Running WHOIS lookups through a third-party service
  • Searching GitHub for code related to the target organization
  • Examining job listings to identify technologies in use
  • Analyzing file metadata from documents published on the target's website

Active Reconnaissance — Defined

Active reconnaissance involves directly interacting with the target's systems and infrastructure.

The defining test: "Does my action generate network traffic that the target could log, detect, or block?" If yes — it is active.

Examples of active reconnaissance activities:

  • Port scanning the target's IP addresses (nmap)
  • Banner grabbing from the target's servers
  • Sending HTTP requests to the target's web application
  • Tracerouting to the target's infrastructure
  • Performing DNS zone transfer attempts against the target's DNS servers
  • Crawling the target's website
  • Sending ping probes to the target's IP ranges

The Legal Distinction

This distinction has direct legal implications:

Aspect Passive Recon Active Recon
Legal risk None — accessing public info Potential CFAA violation if unauthorized
Detection risk Zero — no target interaction High — generates logs on target systems
Pre-authorization Can be performed before authorization is signed Must only be performed after authorization
Log evidence No traces on target Target's IDS/IPS/firewall logs activity
Timing Can begin day 1 of engagement Begins only after ROE is signed

Critical professional practice: Many penetration testers begin passive reconnaissance immediately after being engaged — even before the contract is finalized — because it generates zero legal risk and the intelligence gathered informs the scoping conversation with the client.

The Passive-Active Spectrum

Some activities exist in a gray zone:

Activity Classification Why
Google search for target domain Passive No target interaction
Accessing target's public website Active Generates server logs on target
WHOIS via third-party service Passive Third party handles the lookup
DNS query via your own resolver Active Your resolver queries target's authoritative DNS
DNS query via a third-party tool Passive Third party generates the query
Shodan search for target IPs Passive Shodan already scanned; you view results
Running nmap against target IP Active Direct packets to target
Certificate Transparency logs Passive Accessing third-party CT log databases

Understanding this spectrum allows you to plan exactly what can be done before authorization and what requires a signed contract.

3.1.3 The OSINT Methodology — How Professionals Think

OSINT is not random searching. Professional intelligence analysts follow a structured methodology derived from military and intelligence community practices.

The Intelligence Cycle 

┌─────────────────────────────────────────────────────────┐
│                   INTELLIGENCE CYCLE                     │
│                                                          │
│  1. PLANNING & DIRECTION                                 │
│     Define intelligence requirements                     │
│     What do we need to know? Why?                       │
│          ↓                                               │
│  2. COLLECTION                                           │
│     Gather raw data from multiple sources               │
│          ↓                                               │
│  3. PROCESSING                                           │
│     Convert raw data into usable format                 │
│          ↓                                               │
│  4. ANALYSIS & PRODUCTION                               │
│     Evaluate, correlate, and interpret data             │
│          ↓                                               │
│  5. DISSEMINATION                                        │
│     Deliver intelligence to decision makers             │
│          ↓                                               │
│  6. FEEDBACK                                            │
│     Refine requirements based on results                │
│          └────────────────────────────────────┘         │
└─────────────────────────────────────────────────────────┘

Enter fullscreen mode Exit fullscreen mode

OSINT Intelligence Requirements for Penetration Testing

At the start of passive recon, define what you need to know:

Infrastructure Intelligence:

  • What IP address ranges does the organization own?
  • What domain names and subdomains does the organization operate?
  • What hosting providers and cloud services does the organization use?
  • What technologies (web servers, frameworks, databases) are in use?
  • What externally accessible services are running?

Organizational Intelligence:

  • Who are the key technical personnel (IT staff, developers, security team)?
  • What does the organizational chart look like?
  • What vendors and third-party services does the organization use?
  • What business units exist and what are their functions?

Human Intelligence (HUMINT):

  • What are the email address formats used by the organization?
  • What information do employees publicly share about their work and technologies?
  • What skills do employees list (revealing technologies in use)?
  • What security awareness level do employees demonstrate?

Reputational Intelligence:

  • Has the organization suffered previous data breaches?
  • What is the organization's public security posture?
  • Are there leaked credentials in breach databases?
  • What does the organization's dark web footprint look like?

Historical Intelligence:

  • What did the organization's infrastructure look like in the past?
  • What technologies have they used and potentially still use?
  • What security incidents have been publicly reported?

The Pivot Model

Professional OSINT analysts use a technique called pivoting — using one piece of intelligence to unlock additional intelligence. Every data point discovered can be used to find more:

Organization Name
    ├── Domain Name
    │       ├── IP Addresses (DNS A records)
    │       │       ├── ASN / IP Range
    │       │       │       └── Other IPs in the range → More targets
    │       │       └── Geolocation → Data center / hosting provider
    │       ├── Subdomains
    │       │       └── Each subdomain → New IP → New services
    │       ├── Mail Servers (MX records)
    │       │       └── Email provider → Office 365? G Suite?
    │       └── SSL Certificates
    │               └── Subject Alternative Names → Hidden subdomains
    ├── Executive Names (from LinkedIn)
    │       ├── Email address (using email format)
    │       │       └── Breach data → Leaked passwords → Credential stuffing
    │       └── Social media → Technology disclosures
    └── Job Listings
            └── Technology stack ("requires experience with AWS, Kubernetes, HashiCorp Vault")

Enter fullscreen mode Exit fullscreen mode

This pivot model means that starting with only an organization's name, a skilled analyst can map out the entire attack surface before touching a single target system.

3.1.4 OSINT Tools — The Complete Professional Arsenal

OSINT Framework

OSINT Framework is the foundational resource for any OSINT practitioner. Created by Justin Nordine, it is an interactive, hierarchically organized map of hundreds of OSINT tools and techniques, organized by the type of data you have (starting point) and what you want to find.

Structure of OSINT Framework:

The framework is organized as a tree starting from the type of indicator you possess:

OSINT Framework Root
├── Username
│   ├── Username Search Engines (Sherlock, WhatsMyName)
│   ├── Social Networks
│   └── Forums / Communities
├── Email Address
│   ├── Email Reputation
│   ├── Breach Data
│   └── Associated Accounts
├── Domain Name
│   ├── WHOIS Records
│   ├── DNS Records
│   ├── Subdomains
│   └── Website Analysis
├── IP Address
│   ├── Geolocation
│   ├── Reverse DNS
│   └── Network Information
├── Image / Photo
│   ├── Reverse Image Search
│   └── Facial Recognition
├── Phone Number
│   ├── Carrier Lookup
│   └── Social Media Linked
└── ... (hundreds more branches)

Enter fullscreen mode Exit fullscreen mode

How professionals use OSINT Framework:

  1. Start with what you have (e.g., an email address from a job listing)
  2. Navigate to that branch in the framework
  3. Identify which tools are most appropriate for your objective
  4. Execute the tools in sequence, pivoting from each result

Notation in OSINT Framework:

  • (T) — Tool (requires installation or technical setup)
  • (D) — Dynamic (content changes based on input)
  • (R) — Requires registration/account
  • (M) — Malware warning (use with caution)

OSINT Combine

OSINT Combine is a professional-grade platform developed by Australian OSINT specialists containing tools designed for specific, high-value OSINT tasks. It differentiates itself by focusing on automation and efficiency — reducing the manual effort of common OSINT workflows.

Key tools available on OSINT Combine:

Image Metadata Viewer: Extracts and displays EXIF metadata from images (GPS coordinates, camera model, timestamps) directly in the browser without downloading.

Social Media Search: Cross-platform username and content searches designed to overcome the limitations of native platform search interfaces.

Map Searching Tools: Specialized tools for geolocation analysis and map-based OSINT (verifying locations from photos, tracking movements from social media content).

Domain Investigation Tools: DNS history, WHOIS lookups, and subdomain enumeration integrated into a unified workflow.

Bulk Data Processing: Tools for processing large datasets (e.g., processing multiple usernames or email addresses simultaneously).

Professional Application:

OSINT Combine is particularly valuable for:

  • Social media investigations (identifying accounts across platforms)
  • Geolocation of images shared by employees (potentially revealing office locations, travel patterns, physical security details)
  • Bulk processing when handling large employee lists from LinkedIn

SMART — Start.me Aggregated Resource Tool

SMART solves a specific problem in OSINT practice: the fragmentation of resources. Thousands of practitioners maintain OSINT resource lists on the start.me bookmarking platform. SMART indexes all of these public lists and provides a unified search interface across them.

What makes SMART valuable:

When you are looking for tools related to a specific intelligence requirement — say, "maritime vessel tracking" or "corporate registration databases for Brazil" — SMART quickly surfaces specialized resources that would otherwise require extensive searching.

Use cases:

  • Finding country-specific OSINT resources (corporate registries, electoral rolls, court records)
  • Discovering niche tools for specific data types
  • Building a comprehensive resource list for a specific engagement type

SpiderFoot

SpiderFoot is one of the most powerful automated OSINT tools in existence. It takes a single target indicator (IP address, domain name, email address, person name, or ASN) and automatically queries over 200 data sources to build a comprehensive intelligence profile.

How SpiderFoot Works:

SpiderFoot operates on a modular architecture. Each module queries a specific data source. When one module returns data, it triggers other modules that can use that data as input — creating an automated pivot chain.

Input: targetcompany.com
    ↓
DNS Module → IP addresses: 203.0.113.50, 203.0.113.51
    ↓
IP Whois Module → ASN: AS12345, Organization: Target Company Inc.
    ↓
Netblock Module → Full IP range: 203.0.113.0/24
    ↓
Port Scanner Module → Open ports on all IPs in range
    ↓
Banner Grab Module → Service banners and versions
    ↓
Certificate Module → SSL certs → Subject Alternative Names → New subdomains
    ↓
Shodan Module → Shodan data for each IP
    ↓
Breach Module → Check emails against HaveIBeenPwned
    ... (200+ modules)

Enter fullscreen mode Exit fullscreen mode

SpiderFoot Modules of Highest Value for Penetration Testers:

Module Data Source Intelligence Gathered
sfp_dnsresolve DNS IP addresses for domains
sfp_ssl SSL certificate analysis Subject alternative names, cert history
sfp_shodan Shodan API Open ports, services, banners
sfp_whois WHOIS Registrant info, nameservers
sfp_hunter Hunter.io Email addresses from domain
sfp_hibp HaveIBeenPwned Breach exposure of emails
sfp_linkedin LinkedIn Employee names and roles
sfp_github GitHub Source code, credentials, configs
sfp_pastebin Pastebin Leaked data mentioning target
sfp_virustotal VirusTotal URL/IP reputation, malware association
sfp_threatcrowd ThreatCrowd Threat intelligence correlation
sfp_googlesearch Google Indexed pages, exposed files

Running SpiderFoot:

# Install
pip3 install spiderfoot

# Launch web interface
spiderfoot -l 127.0.0.1:5001

# Command line scan
spiderfoot -s targetcompany.com -t INTERNET_NAME -o json -q

# Scan with specific modules only
spiderfoot -s targetcompany.com -m sfp_dns,sfp_ssl,sfp_shodan -o json

# Full passive scan (no active modules)
spiderfoot -s targetcompany.com --type passive -o json

Enter fullscreen mode Exit fullscreen mode

SpiderFoot vs. Manual OSINT:

Approach Time for Full Domain Recon Breadth
Manual OSINT 4-8 hours Depends on analyst skill
SpiderFoot automated 15-45 minutes 200+ sources automatically

SpiderFoot does not replace human analysis — it accelerates data collection so the analyst can focus on interpretation and pivoting.

Recon-ng

Recon-ng is a full-featured web reconnaissance framework written in Python. Its design is deliberately modeled after Metasploit — experienced penetration testers who know Metasploit will find recon-ng immediately familiar. It provides a powerful, module-based CLI for conducting systematic OSINT campaigns.

Why recon-ng is a professional standard:

  • Database backend: All results are stored in a local SQLite database, enabling complex queries, cross-referencing, and persistent storage across sessions
  • Workspace isolation: Create separate workspaces for each client engagement, keeping data cleanly separated
  • Module ecosystem: Hundreds of modules covering every aspect of OSINT
  • API key management: Centralized management of API keys for services like Shodan, VirusTotal, Hunter.io
  • Reporting: Built-in report generation from collected data
  • Automation: Scripting capability for repeatable reconnaissance workflows

recon-ng Core Concepts:

Workspaces: Isolated databases for each engagement

[recon-ng][default] > workspaces create client_target_co
[recon-ng][client_target_co] >

Enter fullscreen mode Exit fullscreen mode

Modules: The intelligence-gathering engines

[recon-ng][client_target_co] > modules search domains
[*] Searching for 'domains'...

  Discovery
  ---------
    discovery/info_disclosure/interesting_files

  Recon
  -----
    recon/domains-contacts/hunter_io
    recon/domains-credentials/pwnedlist_domain_credentials
    recon/domains-domains/brute_suffix
    recon/domains-hosts/bing_domain_web
    recon/domains-hosts/brute_hosts
    recon/domains-hosts/certificate_transparency
    recon/domains-hosts/google_site_web
    recon/domains-hosts/netcraft
    recon/domains-hosts/shodan_hostname
    recon/domains-hosts/ssl_san
    recon/domains-vulnerabilities/punkspider
    recon/domains-vulnerabilities/xssed
    recon/domains-vulnerabilities/xssposed

Enter fullscreen mode Exit fullscreen mode

The recon-ng Module Naming Convention:

category/subcategory/source

recon/domains-hosts/certificate_transparency
 │         │              │
 │         │              └── Data source used
 │         └── What you HAVE → What you GET (domains → hosts)
 └── Module category

Enter fullscreen mode Exit fullscreen mode

Common recon-ng Workflow:

# Launch recon-ng
recon-ng

# Create workspace for engagement
workspaces create targetco_engagement_2024

# Add seed domain
db insert domains targetco.com

# Find subdomains via certificate transparency
modules load recon/domains-hosts/certificate_transparency
run

# Find subdomains via Bing
modules load recon/domains-hosts/bing_domain_web
run

# Resolve all discovered hosts to IPs
modules load recon/hosts-hosts/resolve
run

# Find email addresses for domain
modules load recon/domains-contacts/hunter_io
options set SOURCE targetco.com
run

# Check emails against breach data
modules load recon/contacts-credentials/hibp_breach
run

# Generate HTML report
modules load reporting/html
options set FILENAME /tmp/targetco_recon_report.html
run

Enter fullscreen mode Exit fullscreen mode

High-Value recon-ng Modules:

Module Input Output
recon/domains-hosts/certificate_transparency Domain Subdomains from CT logs
recon/domains-hosts/shodan_hostname Domain IPs and ports from Shodan
recon/domains-hosts/brute_hosts Domain Subdomain brute force
recon/domains-contacts/hunter_io Domain Email addresses
recon/contacts-credentials/hibp_breach Email Breach data
recon/hosts-ports/shodan_ip IP Address Open ports from Shodan
recon/netblocks-companies/whois_orgs Netblock Organization info
recon/companies-multi/whois_miner Company All WHOIS data
recon/profiles-profiles/linkedin_auth LinkedIn URL Profile details

recon-ng API Key Setup:

recon-ng requires API keys for many of its most powerful modules:

keys add shodan_api [YOUR_KEY]
keys add hunter_api [YOUR_KEY]
keys add virustotal_api [YOUR_KEY]
keys add censys_id [YOUR_ID]
keys add censys_secret [YOUR_SECRET]

Enter fullscreen mode Exit fullscreen mode

Maltego

Website: https://www.maltego.com/

Type: Visual intelligence and link analysis platform

Cost: Community (free, limited), Pro ($999/year), Enterprise

Platform: Cross-platform (Windows, macOS, Linux)

Maltego is the industry-standard tool for visual OSINT analysis and link analysis. Unlike CLI tools, Maltego presents intelligence graphically — as a network graph showing relationships between entities (people, organizations, domains, IPs, emails, social profiles).

Why Maltego is used at the enterprise level:

  • Visual relationship mapping: Instantly reveals connections between entities that would take hours to identify in text-based tools
  • Transform-based automation: "Transforms" are automated queries that expand the graph with new intelligence
  • Maltego Transform Hub: Marketplace of transforms from commercial data providers (Shodan, Have I Been Pwned, VirusTotal, etc.)
  • Collaboration: Teams can share investigation graphs
  • Evidence preservation: The graph is a defensible record of the investigation methodology

Core Maltego Entity Types:

Person, EmailAddress, PhoneNumber, Organization
Domain, URL, Website, DNSName, NSRecord, MXRecord
IPv4Address, Netblock, ASNumber
Social media profiles (Twitter, LinkedIn, Facebook)
File, Document, Phrase

Enter fullscreen mode Exit fullscreen mode

Professional Maltego Workflow:

  1. Add seed entity (e.g., targetco.com as a Domain entity)
  2. Run DNS transforms → discovers A, MX, NS records + IP addresses
  3. Run WHOIS transforms → discovers registrant info
  4. Run SSL transforms → discovers Subject Alternative Names (new subdomains)
  5. Run email transforms → discovers email addresses (via Hunter.io, etc.)
  6. Run breach transforms → checks emails against HaveIBeenPwned
  7. Run social media transforms → finds LinkedIn/Twitter profiles
  8. Run Shodan transforms → enriches IP data with port/service information

The result is a comprehensive, visual map of the target's entire digital presence and the relationships between all discovered entities.

theHarvester

theHarvester is one of the oldest and most reliable passive reconnaissance tools. Its specific focus is gathering email addresses, subdomains, and employee names from multiple public data sources.

Data Sources Supported:

Source What it Finds
Google Emails, subdomains, hosts
Bing Emails, subdomains, hosts
DuckDuckGo Emails, hosts
LinkedIn Employee names
Twitter Usernames, emails
Shodan Hosts, open ports
CertSpotter Subdomains via CT logs
DNSdumpster DNS info, subdomains
Netcraft Subdomains
VirusTotal Subdomains
Hunter.io Emails
Intelx Emails, hosts (requires API key)

Usage:

# Basic domain email and subdomain harvest
theHarvester -d targetco.com -b all

# Specific data sources
theHarvester -d targetco.com -b google,linkedin,shodan

# Limit results and save to file
theHarvester -d targetco.com -b all -l 500 -f /tmp/harvest_results.html

# Include subdomains in search
theHarvester -d targetco.com -b all -s

# Specify virtual host verification
theHarvester -d targetco.com -b all -v

Enter fullscreen mode Exit fullscreen mode

What theHarvester Discovers:

[*] Emails found: 23
--------------------------------------------------
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

[*] Hosts found: 47
--------------------------------------------------
mail.targetco.com:203.0.113.10
vpn.targetco.com:203.0.113.15
dev.targetco.com:10.0.1.100  ← Shadow IT discovery
staging.targetco.com:203.0.113.20  ← Pre-production environment

Enter fullscreen mode Exit fullscreen mode

The discovery of dev.targetco.com and staging.targetco.com — development and staging servers — is one of the most valuable passive recon findings. These environments frequently have weaker security controls than production systems.

Sherlock

Sherlock searches for a specific username across 300+ social media platforms and websites simultaneously. This is invaluable for:

  • Finding all public profiles associated with an employee's known username
  • Identifying personal accounts that may disclose sensitive information
  • Building a complete social profile of a target individual 
# Install
pip3 install sherlock-project

# Search for username
sherlock johndoe_security

# Multiple usernames
sherlock johndoe johndoe_security j.doe

# Specify output file
sherlock johndoe --output /tmp/johndoe_results.txt

Enter fullscreen mode Exit fullscreen mode

hacker.org

Website: https://hacker.org/

Type: Cybersecurity skill development platform / CTF-style challenges

Cost: Free (registration required for challenges)

hacker.org is a training and practice platform designed for developing offensive security skills through hands-on challenges. It is categorized as a skill development resource rather than an OSINT data source, but it is relevant to the information gathering module because it develops the analytical and technical thinking required for reconnaissance.

What hacker.org offers:

  • Programming challenges: Logic and algorithm problems requiring code solutions
  • Cryptography challenges: Breaking and implementing cryptographic systems
  • Web security challenges: Finding and exploiting web vulnerabilities in safe, legal environments
  • Network analysis challenges: Analyzing packet captures and network protocols
  • Steganography challenges: Finding hidden data in images and files
  • CTF-style progressions: Increasing difficulty levels that build systematically on each other

How it builds reconnaissance skills:

Many reconnaissance techniques require exactly the analytical skills developed on hacker.org:

  • Identifying hidden information in files and images (steganography → file metadata analysis)
  • Understanding cryptographic weaknesses (crypto challenges → SSL/TLS vulnerability identification)
  • Finding information in unexpected places (web challenges → advanced Google dorking)
  • Scripting and automation (programming challenges → automated OSINT tool development)

Professional positioning: hacker.org and similar platforms (Hack The Box, TryHackMe, PicoCTF) are increasingly referenced in job interviews as evidence of hands-on skill development.

3.1.5 DNS Lookups — Deep Dive

The Domain Name System (DNS) is one of the most information-rich sources available during passive reconnaissance. DNS records publicly document an organization's infrastructure in ways most organizations do not fully appreciate.

DNS Fundamentals — What Every Senior Penetration Tester Must Know

DNS translates human-readable domain names into machine-readable IP addresses. But its function extends far beyond simple name resolution — it is a distributed database containing multiple record types that reveal extensive infrastructure intelligence.

DNS Architecture:

Client Query: "What is the IP of www.targetco.com?"

Resolver (Recursive DNS Server)
    ↓ (queries if not cached)
Root Name Server → "Ask .com TLD servers"
    ↓
.com TLD Server → "Ask targetco.com's authoritative name servers"
    ↓
Authoritative NS for targetco.com → "203.0.113.50"
    ↓
Answer returned to client: 203.0.113.50

Enter fullscreen mode Exit fullscreen mode

Intelligence value at each layer:

  • Root server queries: Reveal what TLD the organization uses (.com, .gov, .mil, .co.uk — indicates jurisdiction)
  • Authoritative name servers: Reveal DNS hosting provider (AWS Route 53, Cloudflare, GoDaddy — intelligence about infrastructure providers)
  • DNS record types: Each type reveals specific infrastructure details

Complete DNS Record Type Reference

A Record (Address Record)

Maps a hostname to an IPv4 address. The most fundamental DNS record.

# Query A record
dig targetco.com A
nslookup targetco.com

# Response
targetco.com.    300    IN    A    203.0.113.50

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • The IP address enables further intelligence gathering (Shodan, WHOIS for the IP, geolocation)
  • The TTL (Time To Live, in seconds — here: 300 seconds = 5 minutes) reveals caching behavior; very low TTLs suggest load balancing or CDN use; very high TTLs suggest static infrastructure
  • Multiple A records for the same hostname indicate load balancing or CDN

AAAA Record (IPv6 Address Record)

Maps a hostname to an IPv6 address. Organizations increasingly deploy IPv6, and IPv6 addresses are often less well-monitored than IPv4.

dig targetco.com AAAA

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • IPv6 often reveals direct IP addresses even when IPv4 is behind a CDN (like Cloudflare)
  • IPv6 address blocks often reveal the organization's ISP or hosting provider
  • Organizations frequently apply less rigorous security controls to IPv6 paths

MX Record (Mail Exchanger Record)

Specifies the mail servers responsible for accepting email for a domain.

dig targetco.com MX

# Response
targetco.com.    3600    IN    MX    10    mail1.targetco.com.
targetco.com.    3600    IN    MX    20    mail2.targetco.com.
targetco.com.    3600    IN    MX    30    aspmx.l.google.com.   ← G Suite!

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • Reveals email provider (Google Workspace, Microsoft 365, self-hosted Exchange)
  • Google Workspace indicators: aspmx.l.google.com, alt1.aspmx.l.google.com
  • Microsoft 365 indicators: targetco-com.mail.protection.outlook.com
  • Self-hosted Exchange: Typically a subdomain like mail.targetco.com pointing to a corporate IP
  • Email platform reveals authentication methods, phishing opportunities, and password spray targets
  • Backup MX records (lower priority, higher number) sometimes point to less-secure mail relay servers

NS Record (Name Server Record)

Identifies the authoritative DNS servers for a domain.

dig targetco.com NS

# Response
targetco.com.    86400    IN    NS    ns1.targetco.com.
targetco.com.    86400    IN    NS    ns2.targetco.com.

# OR (revealing DNS hosting provider)
targetco.com.    86400    IN    NS    ns-1234.awsdns-12.com.     ← AWS Route 53
targetco.com.    86400    IN    NS    ns-5678.awsdns-34.co.uk.

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • Reveals DNS hosting provider (AWS Route 53, Cloudflare, Azure DNS, Google Cloud DNS)
  • Self-hosted NS records (ns1.targetco.com) reveal additional IP addresses to investigate
  • DNS provider may have security implications (DNS hijacking attacks target specific providers)
  • Cloudflare NS records often mean IPv4 addresses are proxied/hidden

SOA Record (Start of Authority)

Contains administrative information about a DNS zone, including the primary name server and the email address of the zone administrator.

dig targetco.com SOA

# Response
targetco.com.    3600    IN    SOA    ns1.targetco.com. dnsadmin.targetco.com. (
                                      2024010101  ; Serial
                                      3600        ; Refresh
                                      900         ; Retry
                                      604800      ; Expire
                                      300 )       ; Minimum TTL

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • dnsadmin.targetco.com — The second field is the DNS administrator's email address (replace the first . with @): [email protected]
  • This is a direct email address for a technical administrator
  • Serial number format often reveals the last update date (common format: YYYYMMDDNN)

TXT Record (Text Record)

A versatile record type containing arbitrary text. Used for numerous verification and configuration purposes.

dig targetco.com TXT

# Common responses
targetco.com.    3600    IN    TXT    "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.50 ~all"
targetco.com.    3600    IN    TXT    "MS=ms12345678"
targetco.com.    3600    IN    TXT    "google-site-verification=AbCdEfGhIjKlMnOpQrStUvWxYz"
targetco.com.    3600    IN    TXT    "atlassian-domain-verification=AbCdEf12345"

Enter fullscreen mode Exit fullscreen mode

Intelligence value — TXT records are a goldmine:

TXT Record Content Intelligence Revealed
v=spf1 include:_spf.google.com Uses Google Workspace for email
v=spf1 include:sendgrid.net Uses SendGrid for marketing emails
v=spf1 include:_spf.salesforce.com Uses Salesforce (email integration)
v=spf1 ip4:203.0.113.50 Mail server IP (direct IP revelation)
MS=ms12345678 Microsoft 365 domain verification — organization is on Microsoft 365
google-site-verification=... Google Search Console verification — uses Google services
atlassian-domain-verification=... Uses Atlassian products (Jira, Confluence, Bitbucket)
docusign=... Uses DocuSign for e-signatures
stripe-verification=... Uses Stripe for payments (financial data!)
facebook-domain-verification=... Facebook/Meta advertising integration
_dmarc (separate record) DMARC policy (reveals email security posture)

DMARC Record:

dig _dmarc.targetco.com TXT

# Response options
"v=DMARC1; p=none; rua=mailto:[email protected]"    ← No enforcement (easy phishing)
"v=DMARC1; p=quarantine; ..."                          ← Moderate protection
"v=DMARC1; p=reject; ..."                              ← Strong protection

# p=none means phishing emails spoofing @targetco.com will be DELIVERED

Enter fullscreen mode Exit fullscreen mode

DMARC intelligence:

  • p=none — The organization does not enforce DMARC. Spoofed emails using their domain will be delivered to recipients. Directly relevant to phishing pre-text design.
  • The rua (reporting URI) reveals an email address for DMARC reports — a real internal email address.

SPF Record Analysis:

dig targetco.com TXT | grep spf

# v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.salesforce.com ip4:203.0.113.0/24 ip6:2001:db8::/32 ~all

Enter fullscreen mode Exit fullscreen mode

This single SPF record reveals:

  • Google Workspace (corporate email)
  • SendGrid (marketing/transactional email — phishing campaigns often come from here)
  • Salesforce (CRM platform)
  • Direct IP range 203.0.113.0/24 (mail server IPs)
  • IPv6 range 2001:db8::/32

CNAME Record (Canonical Name Record)

Maps one hostname to another hostname (an alias).

dig www.targetco.com CNAME

# Responses
www.targetco.com.    300    IN    CNAME    targetco.com.
www.targetco.com.    300    IN    CNAME    d1234567890.cloudfront.net.    ← CloudFront CDN
www.targetco.com.    300    IN    CNAME    targetco.azurewebsites.net.    ← Azure App Service
www.targetco.com.    300    IN    CNAME    targetco.github.io.            ← GitHub Pages

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • Reveals content delivery networks (CloudFront, Cloudflare, Fastly, Akamai)
  • Reveals cloud hosting services (Azure Web Apps, AWS Elastic Beanstalk, Heroku, GitHub Pages)
  • CNAMEs to third-party services reveal vendor relationships
  • Subdomain takeover: If a CNAME points to a third-party service that is no longer configured, the subdomain may be vulnerable to takeover

PTR Record (Pointer Record / Reverse DNS)

Maps an IP address back to a hostname. The reverse of an A record.

# Reverse DNS lookup
dig -x 203.0.113.50
nslookup 203.0.113.50

# Response
50.113.0.203.in-addr.arpa.    3600    IN    PTR    mail.targetco.com.

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • Reveals the hostname associated with an IP address
  • Particularly valuable when you have an IP from a log, packet capture, or other source and need to identify the system
  • Reveals infrastructure naming conventions (the pattern used in mail.targetco.com vs web01.prod.targetco.com reveals a lot about internal structure)

SRV Record (Service Record)

Specifies the location (hostname and port) of servers for specific services.

dig _sip._tcp.targetco.com SRV
dig _autodiscover._tcp.targetco.com SRV
dig _xmpp-server._tcp.targetco.com SRV

# Response
_autodiscover._tcp.targetco.com.    3600    IN    SRV    0 0 443 autodiscover.targetco.com.

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • _autodiscover._tcp → Microsoft Exchange/Office 365 autodiscovery — confirms Microsoft 365 and reveals Exchange server
  • _sip._tcp → SIP/VoIP server → Voice over IP infrastructure
  • _xmpp-server._tcp → XMPP/Jabber server → Instant messaging
  • _kerberos._tcp → Kerberos → Active Directory present (major finding)
  • _ldap._tcp → LDAP → Active Directory present

CAA Record (Certification Authority Authorization)

Specifies which Certificate Authorities (CAs) are authorized to issue SSL/TLS certificates for the domain.

dig targetco.com CAA

# Response
targetco.com.    3600    IN    CAA    0 issue "letsencrypt.org"
targetco.com.    3600    IN    CAA    0 issue "digicert.com"
targetco.com.    3600    IN    CAA    0 issuewild "digicert.com"

Enter fullscreen mode Exit fullscreen mode

Intelligence value:

  • Reveals which CAs the organization uses → cert monitoring strategy
  • If Let's Encrypt only → likely smaller/budget-conscious operations
  • If DigiCert/Sectigo/Entrust → enterprise-grade certificates
  • Absence of CAA records means any CA can issue certificates → higher phishing certificate risk

3.1.6 DNS Reconnaissance — Advanced Techniques

Zone Transfer (AXFR)

A DNS zone transfer is the mechanism by which DNS servers replicate zone data to secondary servers. If misconfigured, a zone transfer can be requested by anyone, returning the complete list of all DNS records in the zone.

Attempting a zone transfer:

# Identify nameservers first
dig targetco.com NS

# Attempt zone transfer from each nameserver
dig axfr targetco.com @ns1.targetco.com
dig axfr targetco.com @ns2.targetco.com

# Using nslookup
nslookup
> server ns1.targetco.com
> ls -d targetco.com

Enter fullscreen mode Exit fullscreen mode

Successful zone transfer result:

; <<>> DiG 9.18.0 <<>> axfr targetco.com @ns1.targetco.com
targetco.com.        86400    IN    SOA    ns1.targetco.com. admin.targetco.com. ...
targetco.com.        86400    IN    NS     ns1.targetco.com.
targetco.com.        86400    IN    A      203.0.113.50
www.targetco.com.    86400    IN    A      203.0.113.50
mail.targetco.com.   86400    IN    A      203.0.113.10
vpn.targetco.com.    86400    IN    A      203.0.113.15
dev.targetco.com.    86400    IN    A      10.0.1.100
staging.targetco.com. 86400  IN    A      203.0.113.20
db01.targetco.com.   86400    IN    A      10.0.1.200
internal.targetco.com. 86400 IN    A      10.0.0.1

Enter fullscreen mode Exit fullscreen mode

This instantly reveals the entire internal network structure. Zone transfers are considered active reconnaissance (you're querying the target's DNS server), but the information returned is public (just poorly protected).

Note: Most modern, properly configured DNS servers restrict zone transfers to specific secondary server IPs. Zone transfer success is itself a critical vulnerability finding.

DNS Brute Forcing

When zone transfers fail (as they usually should), subdomain discovery is accomplished by brute forcing — querying the target's DNS server with a list of common subdomain names.

# Using dnsx
dnsx -d targetco.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Using ffuf for DNS brute forcing
ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://FUZZ.targetco.com -v

# Using gobuster for DNS enumeration
gobuster dns -d targetco.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt

# Using amass (passive mode — no active queries)
amass enum -passive -d targetco.com