Information Gathering

Module 1 – Information Gathering / Reconnaissance

Complete Practical Tutorial (Passive + Active)

Information Gathering (also called Reconnaissance or OSINT) is the most important phase of any penetration test or bug bounty engagement.

The more accurate information you collect here, the easier every later stage becomes (scanning, exploitation, reporting).

Golden Rule: Start with Passive techniques (no direct contact with the target) and only move to Active techniques when needed.

Step 0: Create a Clean Workspace

Always organize your findings from the beginning:

bashCopy
1mkdir -p ~/recon/target.com/{passive,active,screenshots,notes}
2cd ~/recon/target.com

Create a simple notes file:

bashCopy
1nano notes.md

Part A: Passive Reconnaissance (Stealthy & Legal)

These techniques do not send packets directly to the target’s servers.

1. WHOIS Lookup

bashCopy
1whois target.com | tee passive/whois.txt

What you get:
Registrar, creation date, expiry date, name servers, and sometimes owner email/address.

Pro Tip: Look for old email addresses or related domains.

2. DNS Enumeration with dig

bashCopy
1dig target.com ANY +noall +answer | tee passive/dig-any.txt
2dig target.com MX +short
3dig target.com NS +short
4dig target.com TXT +short
5dig target.com SOA +short

One-liner script to collect everything:

bashCopy
1echo "=== DNS Records for target.com ===" > passive/dns.txt
2for type in A AAAA MX NS TXT SOA CNAME; do
3  echo -e "\n[$type Records]" >> passive/dns.txt
4  dig target.com $type +short >> passive/dns.txt
5done
6cat passive/dns.txt

3. theHarvester (Email, Subdomain & People Finder)

bashCopy
1theHarvester -d target.com -b all -f passive/harvester

Popular sources: google, bing, linkedin, twitter, dnsdumpster, crtsh, etc.

Better version (recommended):

bashCopy
1theHarvester -d target.com -b google,bing,linkedin,crtsh,dnsdumpster,hackertarget -l 500 -f passive/harvester

4. Subdomain Enumeration (Most Important Passive Skill)

Tool 1: Amass (Best overall)

bashCopy
1amass enum -passive -d target.com -o passive/amass-passive.txt
2amass enum -d target.com -o passive/amass-full.txt

Tool 2: Subfinder (Fast & Accurate)

bashCopy
1subfinder -d target.com -o passive/subfinder.txt
2subfinder -d target.com -all -o passive/subfinder-all.txt

Tool 3: Assetfinder + Findomain

bashCopy
1assetfinder --subs-only target.com | tee passive/assetfinder.txt
2findomain -t target.com -u passive/findomain.txt

Powerful Combined Script (run this):

bashCopy
1#!/bin/bash
2domain=$1
3mkdir -p passive
4
5echo "[+] Running Subfinder..."
6subfinder -d $domain -silent -o passive/subfinder.txt
7
8echo "[+] Running Assetfinder..."
9assetfinder --subs-only $domain | tee passive/assetfinder.txt
10
11echo "[+] Running Findomain..."
12findomain -t $domain -q -u passive/findomain.txt
13
14echo "[+] Running Amass Passive..."
15amass enum -passive -d $domain -o passive/amass.txt
16
17# Combine and clean
18cat passive/*.txt | sort -u | tee passive/all-subdomains.txt
19echo "[+] Total unique subdomains: $(wc -l < passive/all-subdomains.txt)"

Save it as recon.sh and run:

bashCopy
1chmod +x recon.sh
2./recon.sh target.com

5. Certificate Transparency Logs

bashCopy
1curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u | tee passive/crtsh.txt

6. Shodan & Censys (Internet-wide Search)

• Shodan CLI: shodan search hostname:target.com
• Censys: Search for certificates and open ports related to the domain.

7. Google Dorks & GitHub Dorking

Useful Google dorks:

site:target.com filetype:pdf
site:target.com inurl:admin
site:target.com "index of"
site:target.com ext:env | ext:sql | ext:bak

GitHub dorks (search on github.com):

"target.com" password
"target.com" api_key
"target.com" filename:.env

Part B: Active Reconnaissance (Direct Contact)

Use these only on targets you have permission to test.

1. WhatWeb – Technology Fingerprinting

bashCopy
1whatweb target.com -a 3 | tee active/whatweb.txt
2whatweb -v target.com | tee active/whatweb-verbose.txt

2. WAF Detection

bashCopy
1wafw00f https://target.com | tee active/waf.txt

3. HTTP Headers Analysis

bashCopy
1curl -I https://target.com | tee active/headers.txt
2curl -I https://www.target.com
3curl -s https://target.com | head -n 50

Interesting headers to look for:

• Server
• X-Powered-By
• X-Frame-Options
• Content-Security-Policy
• Strict-Transport-Security

4. Quick Technology + Title Grabber Script

bashCopy
1#!/bin/bash
2url=$1
3echo "=== Title ==="
4curl -s $url | grep -oP '(?<=<title>).*?(?=</title>)'
5echo -e "\n=== Server Headers ==="
6curl -I -s $url | grep -E "Server|X-Powered-By|X-AspNet"

Recommended Workflow (Use This Every Time)

1. Create folder structure
2. Run WHOIS + dig
3. Run the combined subdomain script
4. Run theHarvester
5. Check crt.sh
6. Run WhatWeb + wafw00f + curl headers
7. Manually browse interesting subdomains
8. Save everything and write a short summary in notes.md

Bonus: One-Command Passive Recon Launcher

bashCopy
1#!/bin/bash
2domain=$1
3mkdir -p recon/$domain/passive
4cd recon/$domain
5
6echo "[+] Starting Passive Recon on $domain"
7whois $domain > passive/whois.txt
8dig $domain ANY +noall +answer > passive/dig.txt
9subfinder -d $domain -silent -o passive/subfinder.txt
10assetfinder --subs-only $domain > passive/assetfinder.txt
11amass enum -passive -d $domain -o passive/amass.txt
12curl -s "https://crt.sh/?q=%25.$domain&output=json" | jq -r '.[].name_value' | sort -u > passive/crtsh.txt
13
14cat passive/*.txt | grep -v "*" | sort -u > passive/all-subs.txt
15echo "[+] Found $(wc -l < passive/all-subs.txt) unique subdomains"

Practice Lab (Do This Now)

1. Choose a safe target (your own domain or a public bug bounty program).
2. Run the combined subdomain script.
3. Run theHarvester.
4. Collect DNS records and WHOIS.
5. Create a summary of interesting findings (emails, subdomains, technologies).

Once you can comfortably collect 100+ subdomains and useful OSINT on a target, you are ready for Module 2 – Network Scanning with Nmap.