knowledge

Overview

Web reconnaissance is the systematic process of collecting information about a target website or web application before conducting deeper analysis or exploitation. It maps the attack surface, identifies assets, uncovers hidden information, and gathers intelligence that guides all subsequent phases of an engagement. Recon divides cleanly into active techniques (which interact directly with the target) and passive techniques (which rely entirely on public sources).

Terminology

TermDefinition
Active ReconnaissanceTechniques that interact directly with the target — higher detection risk
Passive ReconnaissanceTechniques using public third-party sources — minimal detection risk
Attack SurfaceAll exposed points an attacker could exploit to gain access
Banner GrabbingRetrieving service banners to identify software names and versions
FingerprintingIdentifying the technologies, frameworks, OS, and WAF powering a web application
Virtual Host (VHost)A web server configuration hosting multiple sites on one IP via the HTTP Host header
SubdomainAn extension of a primary domain (e.g., blog.example.com) that may point to different infrastructure
Certificate Transparency (CT) LogsPublic, append-only logs of every TLS certificate issued — useful for subdomain discovery
robots.txtA file telling crawlers which paths to avoid; often reveals sensitive or hidden directories
.well-knownA standardized directory on web servers for configuration metadata and security disclosures
Google DorkingUsing advanced search operators to find sensitive information indexed by search engines

Core Concepts

Active Reconnaissance Techniques

Active techniques interact directly with the target’s infrastructure. They yield more specific data but carry a higher risk of triggering IDS/IPS alerts and firewall rules.

TechniqueDescriptionExampleToolsDetection Risk
Port ScanningIdentify open ports and servicesScan for 80 (HTTP) and 443 (HTTPS)Nmap, MasscanHigh
Vulnerability ScanningProbe for known vulnerabilities and misconfigurationsCheck for SQLi and XSS flawsNessus, OpenVAS, NiktoHigh
Network MappingMap network topology and connected devicesTrace packet path with tracerouteTraceroute, NmapMedium–High
Banner GrabbingRetrieve service banners to identify software versionsConnect to port 80 and read HTTP headerNetcat, curlLow
OS FingerprintingIdentify the OS running on the targetUse Nmap -O to detect Windows vs LinuxNmap, Xprobe2Low
Service EnumerationDetermine specific versions of running servicesUse Nmap -sV to identify Apache vs Nginx versionNmapLow
Web SpideringCrawl a website to map pages, directories, and filesRun ZAP Spider to discover hidden resourcesBurp Suite, OWASP ZAPLow–Medium

Passive Reconnaissance Techniques

Passive techniques rely entirely on public data. They never touch the target’s infrastructure and are effectively undetectable.

TechniqueDescriptionExampleToolsDetection Risk
Search Engine QueriesUse operators to find exposed files, panels, and configsite:example.com filetype:pdfGoogle, Shodan, DuckDuckGoVery Low
WHOIS LookupsQuery domain registration databases for registrant, registrar, nameserversLook up registration dates and contact infowhois, online WHOIS servicesVery Low
DNS EnumerationAnalyse DNS records to map infrastructure and discover subdomainsUse dig to enumerate MX, NS, and A recordsdig, nslookup, DNSenumVery Low
Web Archive AnalysisReview historical snapshots of the target’s siteUse Wayback Machine to find old admin pagesWayback MachineVery Low
Social Media AnalysisGather employee info and tech stack clues from public profilesSearch LinkedIn for job titles and required techLinkedIn, OSINT toolsVery Low
Code Repository AnalysisSearch GitHub for exposed credentials or configFind API keys in old commits or config filesGitHub, GitLabVery Low
Certificate TransparencySearch CT logs for subdomains listed in TLS certificatesQuery crt.sh for all certificates issued to example.comcrt.sh, CensysVery Low

Recon Workflow

Passive recon should always precede active recon. Build a complete picture using public data first, then use active techniques to confirm and expand findings.

  1. WHOIS and DNS lookups — registrant info, nameservers, IP ranges, hosting provider
  2. Certificate Transparency — comprehensive subdomain list without touching the target
  3. Search engine dorking — exposed files, admin panels, sensitive directories
  4. Social media and code repositories — staff, tech stack, leaked credentials
  5. Web archive review — old application versions, removed pages, historical configuration
  6. Active fingerprinting — service versions, OS detection, WAF identification
  7. Web crawling — page structure, hidden directories, sensitive file discovery

References / Images