Web Recon

# RULES OF ENGAGEMENT (always re-read)
#   - In-scope:        only domains/IPs in the signed authorisation
#   - Activity:        passive recon, light active probing
#   - Rate:            respect the target's infrastructure; throttle requests
#   - Stealth:         optional (depends on the engagement)
#   - Reporting:       findings within 24h; critical bugs immediately
#   - Lab practice:    OWASP Juice Shop, DVWA, PortSwigger Web Security Academy, HackTheBox

# === 1. Passive recon (no traffic hits the target) ===

# Subdomain enumeration via public sources
amass enum -passive -d example.com -o subs-passive.txt
subfinder -d example.com -all -silent | tee -a subs-passive.txt

# Certificate Transparency
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u

# Search engines / archives
# Google dorks (use carefully, respectfully)
#   site:example.com filetype:pdf
#   site:example.com inurl:admin
#   site:example.com intext:'API_KEY' OR 'BEGIN PRIVATE KEY'

# Wayback Machine
curl -s 'http://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=text&fl=original&collapse=urlkey' | tee wayback.txt

# GitHub — secrets in public repos
#   github.com/search?q=%22example.com%22+api_key
#   trufflehog scans org repos for hardcoded credentials
trufflehog github --org example-org

# Pastebin / leak databases (HaveIBeenPwned API, DeHashed) — only with authorisation

# === 2. Active recon (sends traffic) — needs explicit authorisation ===

# Live host probing
cat subs-passive.txt | httpx -silent -title -status-code -tech-detect -follow-redirects -o live.txt
# Output: subdomain  status  title  tech-stack

# Directory + file brute-force
ffuf -u https://app.example.com/FUZZ -w wordlists/raft-medium-directories.txt -mc 200,301,302,401,403 -ac
feroxbuster -u https://app.example.com -w wordlists/common.txt -s 200,301,302,401,403

# Common paths to probe
#   /robots.txt /sitemap.xml /.well-known/security.txt
#   /admin /login /api /api/v1 /api/v2 /graphql /swagger /docs /openapi.json
#   /.git/config /.env /.DS_Store /backup.zip /db.sql

# Technology detection
whatweb https://app.example.com
wappalyzer-cli https://app.example.com
nuclei -tags tech -u https://app.example.com

# Visual recon — screenshot every live host
gowitness file -f live.txt --threads 8
EyeWitness -f live.txt --web

# === 3. JavaScript analysis — find hidden endpoints + secrets ===

# Pull every JS file
gau example.com | grep -E '\.js($|\?)' | sort -u > js-files.txt

# LinkFinder — extract endpoints from JS
python3 LinkFinder.py -i app.js -o cli

# SecretFinder — secrets in JS
python3 SecretFinder.py -i app.js -o cli

# === 4. API recon ===

# OpenAPI / Swagger
curl -s https://api.example.com/openapi.json | jq '.paths'

# GraphQL introspection (often left on in dev)
curl -X POST https://api.example.com/graphql \
    -H 'content-type: application/json' \
    -d '{"query":"{__schema{types{name fields{name}}}}"}' | jq '.'

# Postman collections / shared API docs — often leak in public Notion/GitHub

# === 5. Cloud-specific recon ===

# S3 buckets
cloud_enum -k example -k example.com -t 30
# Or:
aws s3 ls s3://example-prod-backups --no-sign-request

# Azure / GCP equivalents (with proper auth)

# === 6. Common file leaks to check ===

#   /.git/HEAD                 — exposed git repo
#   /.env                       — env vars
#   /config.php                 — server-side config
#   /backup.zip /backup.tar.gz
#   /db.sql /dump.sql
#   /phpinfo.php
#   /.DS_Store                  — directory listing on macOS
#   /server-status              — Apache mod_status
#   /actuator/health            — Spring Boot

nuclei -t nuclei-templates/exposures -u https://target/

# === 7. Email + people recon ===

# Hunter.io — find email format + employees (free tier)
# https://hunter.io/example.com

# theHarvester — emails, subdomains, employees
theHarvester -d example.com -l 500 -b google,bing,linkedin

# LinkedIn — org chart for social engineering context (don't actually engineer humans without express permission)

# === 8. Document a finding (the format that matters) ===

# Finding: <Short title>
# Severity: Critical / High / Medium / Low / Info
# Affected: <URL / domain>
# Description: What it is, why it's bad
# Reproduction:
#   1. Curl / Burp request
#   2. Response showing the issue
#   3. Screenshot if helpful
# Impact: Concrete worst-case (data exposed, accounts compromised, etc.)
# Recommendation: Specific fix (not just 'patch')
# References: Relevant CVE / CWE / OWASP entries

# === 9. Pipeline — recon to actionable findings ===

amass enum -passive -d example.com -o subs.txt
cat subs.txt | httpx -silent -title -tech-detect -o live.txt
cat live.txt | awk '{print $1}' | nuclei -t ~/nuclei-templates/ -severity critical,high -o findings.txt
cat live.txt | gowitness file -f /dev/stdin

# === 10. Stay within bounds ===

#   ❌ Aggressive scanning that DOSes the target
#   ❌ Touching out-of-scope subdomains (third-party services, subsidiaries)
#   ❌ Active exploitation without explicit permission (recon != exploitation)
#   ❌ Using prod environment for proof of impact when staging would suffice
#   ❌ Sharing findings publicly before responsible disclosure window closes

# === 11. Defender's mirror ===

#   • Continuous CT log monitoring (Cert Spotter)
#   • External attack surface management (Detectify, Hadrian, SpyCloud)
#   • Scan your own repos for secrets (gitleaks, trufflehog in CI)
#   • Honeytoken subdomains — never used in marketing; flag any DNS hit
#   • Rate-limit + WAF the obvious paths attackers probe
#   • DNS audit: remove stale subdomain pointers (dangling CNAMEs → subdomain takeover risk)

# Map the app before you test it.
#   - Capture all URLs via the browser + Burp/ZAP proxy
#   - Note auth flows, roles, and APIs
#   - Identify the stack (Wappalyzer, HTTP headers, JS bundles)
#   - Look at robots.txt, sitemap.xml, /.well-known/, /api docs