The Recon Playbook Every Hacker Uses (But No One Talks About)b

Hii Amigos!
Most people treat recon like a simple checklist but real hackers know it’s where most of the work (and the best bugs) actually come from. In this guide, I’m breaking down the ultimate recon workflow, from basic steps to advanced techniques that uncovers hidden assets and attack surfaces no scanner will ever show you.
Welcome to our The Recon Playbook Every Hacker Uses.

There is a famous saying like युद्धाय कर्तव्यं कर्म पूर्वं विद्यात्। which means Before entering the battle, one must first understand their duty and know the field

The first step is to define your Attack surface and categorize the target into three levels like

1)Low scope targets(Small Surface Area)
2)Medium-Scope Targets (Moderate Surface Area)
3)Huge-Scope Targets (Enterprise-Level / Large Attack Surface)

1)Low scope targets(Small Surface Area)
2)Medium-Scope Targets (Moderate Surface Area)
3)Huge-Scope Targets (Enterprise-Level / Large Attack Surface)

Irrespective of Attack surfaces lets dive into enumeration part. Basically there are two different types of enumerations they are

1)Horizantal Enumeration
2)Vertical Enumeration

1)Horizantal Enumeration
2)Vertical Enumeration

1. Horizontal Enumeration(Breadth-First Recon):

Horizontal enumeration means expanding wide across the attack surface instead of going deep on a single domain.Its like exploring all the roads in a city before choosing which house to break into.

2.Vertical Enumeration (Depth-First Recon):
Vertical enumeration means going deep into a single target instead of spreading wide. It’s like finding one house and then exploring every room, basement, secret door, and hidden passage inside it. You focus on one domain or endpoint and dig layer by layer until you fully understand everything beneath the surface.

ok now lets get our hands dirty

If your attack surface is very huge.
First understand the target and collect all the acquisitions of our target. For example consider google as your target (Mandiant,Motorola Mobility,Nest Labs,DoubleClick,Looker,Fitbit,YouTube,Waze,,Impermium,Anvato,Kaggle,DeepMind and many more )You can get about these acquisitions in the internet a small google search or AI search can give you all the Acquisitions of the target.

If you are doing any Blackhat understand the architecture of the target like who is owning the company what are the subsidiary companies and acquisitions as well construct the flow and choose the weakest target from the info you gathered and then try to escalate it that target level by finding appropriate bugs(Author is not responsible for any illegal and misuse of this content.This article was intended for purely educated purposes only).

Now find the ASN and Ip ranges of the target for that we can use https://bgp.he.net/ and get the ASN numbers or one can also use github tools like

Now select the ASN and use whois to find the IP ranges of that.For example lets pick AS394089

─$ whois -h whois.radb.net -- '-i origin AS394089' | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq -u

─$ whois -h whois.radb.net -- '-i origin AS394089' | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq -u

use the above command to find all the ip ranges in that ASN range

Now select an ip range and save it in a text file and resolve it to domain names using mapcidr and hakrevdns the following command

cat ip.txt | mapcidr -si -silent -o ips.txt | cat ips.txt | hakrevdns -t 100 -d | anew domains.txt

cat ip.txt | mapcidr -si -silent -o ips.txt | cat ips.txt | hakrevdns -t 100 -d | anew domains.txt

you can use any of our github tools as there are lots of tools available in the market the main goal is resolve that ip range into subdomains.Bigger attack surface pick all the ip ranges and resolve them into subdomains.now keep these subdomains apart.Now take the main domain and use some platforms like security trails, c99 subfinder,crt.sh,virus total ,way back machine,shodan,fofa,censys … and collect the subdomains as many as you can

some of the traditional techniques are described below

assetfinder-subdomains.txt
subenum -d target.com -r
bbot -t target.com -p subdomain-enum
amass enum -passive -d target.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass-subs1.txt
amass enum -active -d target.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass-subs2.txt” data-toggle-ms=”1200″ aria-label=”Copy code” data-nosnippet=”” class=”code-copy-btn absolute right-3 top-3 size-8 p-1.5 flex items-center justify-center bg-black/50 text-white rounded-md transition-colors duration-200 cursor-pointer hover:bg-black/70″>

subfinder -d target.com -all -recursive -o subfinder-subdomains.txt
assetfinder --subs-only target.com > assetfinder-subdomains.txt
subenum -d target.com -r
bbot -t target.com -p subdomain-enum
amass enum -passive -d target.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass-subs1.txt
amass enum -active -d target.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass-subs2.txt

subfinder -d target.com -all -recursive -o subfinder-subdomains.txt
assetfinder --subs-only target.com > assetfinder-subdomains.txt
subenum -d target.com -r
bbot -t target.com -p subdomain-enum
amass enum -passive -d target.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass-subs1.txt
amass enum -active -d target.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass-subs2.txt

As subfinder and subenum were passive enum tools and also they covers most of the available platforms so add api key to get better results.And you can also perform Bruteforce using ffuf for subdomains you can try seclists

ffuf -u “https://FUZZ.target.com” -w seclists-wordlist.txt -mc 200,301,302

now after gathering all the subdomains make them into a single file and find the active subdomains out of the using httpx-toolkit

live-subs.txt
” data-toggle-ms=”1200″ aria-label=”Copy code” data-nosnippet=”” class=”code-copy-btn absolute right-3 top-1/2 -translate-y-1/2 size-8 p-1.5 flex items-center justify-center bg-black/50 text-white rounded-md transition-colors duration-200 cursor-pointer hover:bg-black/70″>

cat total-subdomains.txt | httpx-toolkit -ports 80,443 > live-subs.txt

cat total-subdomains.txt | httpx-toolkit -ports 80,443 > live-subs.txt

Now you will have a list of active subdomains and filter out them to get unique urls so that no duplicates will be present and then you can use aquatone/Eyewitness/gowitness/screenshotter …. lots of tools available.after getting the screenshots you can manually inspect or if you use eyeballer it will analyse the screenshots. And decide on which target to pentest or maintain table according to the order of target to hunt/pentest.

Now on all the subdomains use paramspider ,katana,x8,arjun,gau,urldedupe to find endpoints in the live-subs.txt

urls.txt
cat urls.txt | grep -E ".php|.asp|.aspx|.jspx|.jsp" | grep '=' | sort > output.txt
cat output.txt | sed 's/=.*/=/' >final.txt” data-toggle-ms=”1200″ aria-label=”Copy code” data-nosnippet=”” class=”code-copy-btn absolute right-3 top-3 size-8 p-1.5 flex items-center justify-center bg-black/50 text-white rounded-md transition-colors duration-200 cursor-pointer hover:bg-black/70″>

paramspider -l live-subs.txt
katana -u live-subs.txt -d 2 -o endpoints.txt
echo target.com | gau --mc 200 | urldedupe >urls.txt
cat urls.txt | grep -E ".php|.asp|.aspx|.jspx|.jsp" | grep '=' | sort > output.txt
cat output.txt | sed 's/=.*/=/' >final.txt

paramspider -l live-subs.txt
katana -u live-subs.txt -d 2 -o endpoints.txt
echo target.com | gau --mc 200 | urldedupe >urls.txt
cat urls.txt | grep -E ".php|.asp|.aspx|.jspx|.jsp" | grep '=' | sort > output.txt
cat output.txt | sed 's/=.*/=/' >final.txt

And now focus on google dorking and Github dorking to find sensitive files ,API keys or creds, js endpoints.

site:example.com -www -shop -share -ir -mfa
site:example.com ext:php inurl:?
site:example[.]com inurl:api | site:*/rest | site:*/v1 | site:*/v2 | site:*/v3
site:"example[.]com" ext:log | ext:txt | ext:conf | ext:cnf | ext:ini | ext:env | ext:sh | ext:bak | ext:backup | ext:swp | ext:old | ext:~ | ext:git | ext:svn | ext:htpasswd | ext:htaccess | ext:json
inurl:conf | inurl:env | inurl:cgi | inurl:bin | inurl:etc | inurl:root | inurl:sql | inurl:backup | inurl:admin | inurl:php site:example[.]com
inurl:"error" | intitle:"exception" | intitle:"failure" | intitle:"server at" | inurl:exception | "database error" | "SQL syntax" | "undefined index" | "unhandled exception" | "stack trace" site:example[.]com
inurl:q= | inurl:s= | inurl:search= | inurl:query= | inurl:keyword= | inurl:lang= inurl:& site:example.com
inurl:url= | inurl:return= | inurl:next= | inurl:redirect= | inurl:redir= | inurl:ret= | inurl:r2= | inurl:page= inurl:& inurl:http site:example.com
inurl:id= | inurl:pid= | inurl:category= | inurl:cat= | inurl:action= | inurl:sid= | inurl:dir= inurl:& site:example.com
inurl:http | inurl:url= | inurl:path= | inurl:dest= | inurl:html= | inurl:data= | inurl:domain=  | inurl:page= inurl:& site:example.com
inurl:include | inurl:dir | inurl:detail= | inurl:file= | inurl:folder= | inurl:inc= | inurl:locate= | inurl:doc= | inurl:conf= inurl:& site:example.com
inurl:cmd | inurl:exec= | inurl:query= | inurl:code= | inurl:do= | inurl:run= | inurl:read=  | inurl:ping= inurl:& site:example.com
site:example.com intext:”choose file” | intext:"select file" | intext:"upload PDF"
inurl:login | inurl:signin | intitle:login | intitle:signin | inurl:secure site:example[.]com
inurl:test | inurl:env | inurl:dev | inurl:staging | inurl:sandbox | inurl:debug | inurl:temp | inurl:internal | inurl:demo site:example.com
site:example.com ext:txt | ext:pdf | ext:xml | ext:xls | ext:xlsx | ext:ppt | ext:pptx | ext:doc | ext:docx
intext:“confidential” | intext:“Not for Public Release” | intext:”internal use only” | intext:“do not distribute”
inurl:/content/usergenerated | inurl:/content/dam | inurl:/jcr:content | inurl:/libs/granite | inurl:/etc/clientlibs | inurl:/content/geometrixx | inurl:/bin/wcm | inurl:/crx/de site:example[.]com
site:firebaseio.com "example[.]com"

site:example.com -www -shop -share -ir -mfa
site:example.com ext:php inurl:?
site:example[.]com inurl:api | site:*/rest | site:*/v1 | site:*/v2 | site:*/v3
site:"example[.]com" ext:log | ext:txt | ext:conf | ext:cnf | ext:ini | ext:env | ext:sh | ext:bak | ext:backup | ext:swp | ext:old | ext:~ | ext:git | ext:svn | ext:htpasswd | ext:htaccess | ext:json
inurl:conf | inurl:env | inurl:cgi | inurl:bin | inurl:etc | inurl:root | inurl:sql | inurl:backup | inurl:admin | inurl:php site:example[.]com
inurl:"error" | intitle:"exception" | intitle:"failure" | intitle:"server at" | inurl:exception | "database error" | "SQL syntax" | "undefined index" | "unhandled exception" | "stack trace" site:example[.]com
inurl:q= | inurl:s= | inurl:search= | inurl:query= | inurl:keyword= | inurl:lang= inurl:& site:example.com
inurl:url= | inurl:return= | inurl:next= | inurl:redirect= | inurl:redir= | inurl:ret= | inurl:r2= | inurl:page= inurl:& inurl:http site:example.com
inurl:id= | inurl:pid= | inurl:category= | inurl:cat= | inurl:action= | inurl:sid= | inurl:dir= inurl:& site:example.com
inurl:http | inurl:url= | inurl:path= | inurl:dest= | inurl:html= | inurl:data= | inurl:domain=  | inurl:page= inurl:& site:example.com
inurl:include | inurl:dir | inurl:detail= | inurl:file= | inurl:folder= | inurl:inc= | inurl:locate= | inurl:doc= | inurl:conf= inurl:& site:example.com
inurl:cmd | inurl:exec= | inurl:query= | inurl:code= | inurl:do= | inurl:run= | inurl:read=  | inurl:ping= inurl:& site:example.com
site:example.com intext:”choose file” | intext:"select file" | intext:"upload PDF"
inurl:login | inurl:signin | intitle:login | intitle:signin | inurl:secure site:example[.]com
inurl:test | inurl:env | inurl:dev | inurl:staging | inurl:sandbox | inurl:debug | inurl:temp | inurl:internal | inurl:demo site:example.com
site:example.com ext:txt | ext:pdf | ext:xml | ext:xls | ext:xlsx | ext:ppt | ext:pptx | ext:doc | ext:docx
intext:“confidential” | intext:“Not for Public Release” | intext:”internal use only” | intext:“do not distribute”
inurl:/content/usergenerated | inurl:/content/dam | inurl:/jcr:content | inurl:/libs/granite | inurl:/etc/clientlibs | inurl:/content/geometrixx | inurl:/bin/wcm | inurl:/crx/de site:example[.]com
site:firebaseio.com "example[.]com"

And also check for any leaks or data breaches on the specific target and now perform portscans on the ip addresses and note down the protocols ,services and their versions by looking at each live website note down the technology stack,CMS and their versions using wappalyzer extension.

Now all with information we are good to go and start hunting and look for real vulnerabilities that will impact.

The tools tools i mentioned and that were to be downloaded are

https://github.com/OWASP/Amass
https://github.com/hakluke/hakrevdns
https://github.com/projectdiscovery/subfinder
https://github.com/tomnomnom/assetfinder
https://github.com/blacklanternsecurity/bbot
https://github.com/aboul3la/Sublist3r
https://github.com/FortyNorthSecurity/EyeWitness
https://github.com/BishopFox/eyeballer
https://github.com/projectdiscovery/katana
https://github.com/GerbenJavado/LinkFinder
https://github.com/zseano/JS-Scan
https://github.com/tomnomnom/waybackurls
https://github.com/s0md3v/Arjun
https://github.com/devanshbatham/ParamSpider
https://github.com/Sh1Yo/x8
https://github.com/zricethezav/gitleaks
https://github.com/dxa4481/truffleHog

https://github.com/OWASP/Amass
https://github.com/hakluke/hakrevdns
https://github.com/projectdiscovery/subfinder
https://github.com/tomnomnom/assetfinder
https://github.com/blacklanternsecurity/bbot
https://github.com/aboul3la/Sublist3r
https://github.com/FortyNorthSecurity/EyeWitness
https://github.com/BishopFox/eyeballer
https://github.com/projectdiscovery/katana
https://github.com/GerbenJavado/LinkFinder
https://github.com/zseano/JS-Scan
https://github.com/tomnomnom/waybackurls
https://github.com/s0md3v/Arjun
https://github.com/devanshbatham/ParamSpider
https://github.com/Sh1Yo/x8
https://github.com/zricethezav/gitleaks
https://github.com/dxa4481/truffleHog

The more you understand about target both in width and depth then the more weird little doors start showing up that you never expected. Sure, tools and automation help a lot, but the real win comes from being curious, patient and thinking a bit differently. Whether you’re spreading out with horizontal enumeration or vertical enumeration remember most hackers actually win during recon. Tools are temporary but the basic fundamentals and the right way to approach is ultimate key to success.

Follow and clap for more interesting content

…………………………….__Thank you for reading!…………………………………..

If you need professional pentesting(Web app ,Network,Android and ios)or red team engagements to strengthen your organization’s defenses, feel free to contact me at [email protected](https://www.linkedin.com/in/kosanam-harish-737815213/). I’m here to help you identify vulnerabilities and build robust security strategies to stay ahead of emerging threats.Stay curious, stay secure, and thank you reading