IntermediateOSINT

Reconnaissance Workflow: Complete Information Gathering Process

Learn a complete reconnaissance workflow combining OSINT, DNS enumeration, subdomain discovery, and active scanning for comprehensive target profiling.

#Reconnaissance#OSINT#Workflow#Information Gathering#Penetration Testing

Structured Intelligence Collection

Reconnaissance is the systematic process of gathering intelligence about a target before any engagement. A structured workflow ensures methodical coverage, avoids gaps in data collection, and produces repeatable, verifiable results. This methodology combines passive intelligence gathering (leveraging public sources without target interaction) with active probing to build a comprehensive target profile.

Prerequisites

Before using this workflow, you should understand:

**OSINT Introduction** — Information gathering fundamentals

**DNS Enumeration** — DNS querying and record types

**Subdomain Enumeration** — Finding hidden attack surface

**Amass Guide** — Attack surface mapping

**Google Dorking Guide** — Search engine techniques

Reconnaissance Phases

Phase 1: Passive Reconnaissance (No Target Interaction)

Gather information without touching the target's infrastructure:

# 1. WHOIS Lookup
whois target.com

# 2. DNS Records
dig target.com ANY +short
dig target.com MX +short
dig target.com NS +short
dig target.com TXT +short

# 3. Certificate Transparency Logs
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# 4. Google Dorking
site:target.com -www
site:target.com filetype:pdf
site:target.com inurl:admin

# 5. Social Media
# LinkedIn — Find employees and technologies
# Twitter — Support handles, status pages
# GitHub — Search for target.com in code

Phase 2: DNS Enumeration

# 1. Zone Transfer Attempt
for ns in $(dig target.com NS +short); do
    dig @$ns target.com AXFR +short 2>/dev/null
done

# 2. Subdomain Brute Forcing
dnsrecon -d target.com -D /usr/share/wordlists/dns/subdomains-top1million-20000.txt -t brt

# 3. Amass Enumeration
amass enum -active -d target.com -brute -o amass_results.txt

# 4. Virtual Host Discovery
ffuf -w subdomains.txt:HOST -u https://TARGET_IP -H "Host: HOST.target.com" -fc 400,403,404

Phase 3: Active Scanning

# 1. Host Discovery
nmap -sn 203.0.113.0/24 -oA host_discovery

# 2. Port Scanning
nmap -sS -T4 -p- --min-rate=10000 -iL live_hosts.txt -oA all_ports

# 3. Service Detection
nmap -sV -sC -T4 -iL live_hosts.txt -p $(paste -sd, open_ports.txt) -oA services

# 4. Vulnerability Scanning
nmap --script vuln -iL live_hosts.txt -p $(paste -sd, open_ports.txt) -oA vulns

Phase 4: Web Application Reconnaissance

# 1. Technology Detection
whatweb target.com
wappalyzer_cli target.com

# 2. Directory Brute Forcing
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

# 3. Parameter Fuzzing
ffuf -u 'https://target.com/page?FUZZ=test' -w parameters.txt

# 4. Spidering and Crawling
# Using Burp Suite Spider or ZAP Spider
# Extract endpoints from JavaScript
cat bundle.js | grep -oP '"/api/[^"]+"' | sort -u

Complete Automation Script

#!/bin/bash
# full-recon.sh — Complete reconnaissance workflow
# Usage: ./full-recon.sh target.com

DOMAIN=$1
OUTPUT_DIR="recon_$DOMAIN"
mkdir -p "$OUTPUT_DIR"

echo "[+] Starting reconnaissance for $DOMAIN"
date
echo ""

# === Phase 1: Passive Recon ===
echo "=== Phase 1: Passive Reconnaissance ==="

echo "[*] WHOIS Lookup"
whois "$DOMAIN" > "$OUTPUT_DIR/whois.txt"

echo "[*] DNS Records"
for type in A AAAA MX NS TXT SOA CNAME; do
    dig "$DOMAIN" "$type" +short > "$OUTPUT_DIR/dns_${type}.txt"
done

echo "[*] Certificate Transparency"
curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" |     jq -r '.[].name_value' | sort -u > "$OUTPUT_DIR/crt_sh.txt"

# === Phase 2: Subdomain Enumeration ===
echo "=== Phase 2: Subdomain Enumeration ==="

echo "[*] DNS Zone Transfer"
for ns in $(dig "$DOMAIN" NS +short 2>/dev/null); do
    dig "@$ns" "$DOMAIN" AXFR +short 2>/dev/null >> "$OUTPUT_DIR/zone_transfer.txt"
done

echo "[*] Amass Enumeration"
amass enum -passive -d "$DOMAIN" -o "$OUTPUT_DIR/amass_passive.txt"
amass enum -active -d "$DOMAIN" -brute -o "$OUTPUT_DIR/amass_active.txt"
cat "$OUTPUT_DIR/amass_passive.txt" "$OUTPUT_DIR/amass_active.txt" |     sort -u > "$OUTPUT_DIR/all_subdomains.txt"

echo "[*] Resolving Subdomains"
for sub in $(cat "$OUTPUT_DIR/all_subdomains.txt"); do
    host "$sub" 2>/dev/null | grep "has address" >> "$OUTPUT_DIR/resolved.txt"
done

# === Phase 3: Port Scanning ===
echo "=== Phase 3: Port Scanning ==="

echo "[*] Extracting unique IPs"
awk '{print $NF}' "$OUTPUT_DIR/resolved.txt" | sort -u > "$OUTPUT_DIR/ips.txt"

echo "[*] Nmap Service Scan"
nmap -sV -sC -T4 -iL "$OUTPUT_DIR/ips.txt" -oA "$OUTPUT_DIR/nmap_scan"

# === Phase 4: Web Recon ===
echo "=== Phase 4: Web Reconnaissance ==="

echo "[*] Technology Detection"
while read -r sub; do
    whatweb "$sub" >> "$OUTPUT_DIR/technologies.txt" 2>/dev/null
done < "$OUTPUT_DIR/all_subdomains.txt"

echo "[+] Reconnaissance complete!"
echo "Results saved to $OUTPUT_DIR/"
date

Data Correlation and Analysis

Finding Relationships

# Find IPs hosting multiple subdomains
awk '{print $1, $NF}' subdomains_and_ips.txt | sort -k2 | uniq -f1 -D

# Identify shared hosting
for ip in $(cat ips.txt); do
    count=$(grep -c "$ip" subdomains_and_ips.txt)
    echo "$ip: $count subdomains"
done | sort -t: -k2 -rn

# Find technologies used across assets
cat technologies.txt | sort | uniq -c | sort -rn

Attack Surface Visualization

# Create network map
echo "graph Target {" > attack_surface.dot
for sub in $(cat subdomains.txt); do
    ip=$(host "$sub" | grep "has address" | awk '{print $NF}')
    if [ -n "$ip" ]; then
        echo "  "$sub" -- "$ip";" >> attack_surface.dot
    fi
done
echo "}" >> attack_surface.dot
dot -Tpng attack_surface.dot -o attack_surface.png

Real-World Application

Bug Bounty Reconnaissance

# Full recon pipeline for bug bounty
1. Passive recon: WHOIS, DNS, crt.sh, Google dorking
2. Subdomain enumeration: Amass, dnsrecon, Sublist3r
3. Live host detection: httprobe
4. Technology identification: whatweb
5. Directory brute forcing: ffuf, gobuster
6. Parameter discovery: Arjun
7. Screenshotting: Aquatone, gowitness
8. Vulnerability scanning: Nuclei

Penetration Test Engagement

# Week 1: External Reconnaissance
- Gather all public information
- Identify all external assets
- Map technology stack
- Find exposed services

# Week 2: Active Scanning
- Port and service scanning
- Vulnerability scanning
- Web application testing
- Network mapping

Common Mistakes

Skipping passive phase: Active scanning alerts defenders. Complete passive recon first.

Not documenting findings: Record everything — data becomes useful later in the engagement.

Being too noisy: Aggressive scanning triggers alarms. Start slow, escalate as needed.

Not verifying data: False positives waste time. Verify subdomains, port status, and vulnerabilities.

Best Practices

**Start passive, move to active** — Minimize target interaction initially

**Automate repeatable tasks** — Create scripts for common workflows

**Document everything** — Findings inform later phases

**Correlate data sources** — Cross-reference DNS, WHOIS, web data

**Organize output** — Use consistent directory structure

**Iterate** — Each finding leads to new recon opportunities

**Stay legal** — Only assess authorized targets

Related Tools

**Amass** — Comprehensive attack surface mapping

**dnsrecon** — DNS enumeration

**theHarvester** — Email and domain intelligence

**recon-ng** — Reconnaissance framework

**Maltego** — Link analysis and visualization

**Nmap** — Network discovery and scanning

**ffuf** — Web fuzzing tool

OSINT Introduction

DNS Enumeration

Subdomain Enumeration

Amass Guide

Google Dorking Guide

Summary

A complete reconnaissance workflow combines passive intelligence gathering, DNS enumeration, subdomain discovery, port scanning, and web application recon. Start passive, move to active, document everything, and iterate based on findings. Automating the workflow ensures consistency and repeatability across assessments.

Knowledge Check

Why is passive reconnaissance performed before active?

What are the four main phases of the recon workflow?

How does data correlation improve reconnaissance results?

Why should reconnaissance findings be documented?

What is the advantage of automating reconnaissance scripts?

Frequently Asked Questions

What are the main phases of a reconnaissance workflow?

The four phases are: (1) Passive Recon (WHOIS, DNS, Google dorking without touching target), (2) DNS Enumeration (zone transfers, subdomain brute forcing), (3) Active Scanning (Nmap port/service scanning), and (4) Web Application Recon (technology detection, directory brute forcing).

Why is passive reconnaissance performed before active?

Passive techniques gather intelligence without sending traffic to the target, keeping your activities undetectable. This builds a foundation for targeted active scanning, reducing noise and improving efficiency.

How does data correlation improve reconnaissance?

Cross-referencing DNS, WHOIS, web, and certificate data reveals relationships between assets. Finding IPs hosting multiple subdomains identifies shared infrastructure. Correlation turns isolated findings into actionable intelligence.

What is the purpose of the automation script in this workflow?

The automation script standardizes the recon process, ensuring consistency across assessments. It runs all phases sequentially, organizes output in structured directories, and produces repeatable results that can be compared over time.

How does directory brute forcing fit into web recon?

Directory brute forcing (gobuster, ffuf) discovers hidden paths like admin panels, backup files, and API endpoints not linked from the main site. These often reveal sensitive functionality or misconfigurations.

What is virtual host discovery?

Virtual host discovery uses HTTP requests with different Host headers to find websites hosted on the same IP. This reveals additional applications and subdomains not visible through DNS enumeration alone.

How do you create an attack surface visualization?

Generate a Graphviz DOT file mapping subdomains to their IP addresses. The `dot` command converts this to PNG. This visual map helps identify critical infrastructure and attack paths at a glance.

What tools are essential for a complete recon workflow?

Essential tools include Amass (subdomain discovery), dnsrecon (DNS enumeration), Nmap (port/service scanning), whatweb (technology detection), gobuster/ffuf (directory brute forcing), and Burp Suite (web application testing). See [Amass Guide](/learn/amass-guide) and [DNS Enumeration](/learn/dns-enumeration) for details.

Why document everything during reconnaissance?

Findings from early phases inform later phases — a discovered subdomain leads to port scanning, which reveals services, which leads to vulnerability scanning. Documentation also creates an audit trail for the engagement.

What is the difference between bug bounty and penetration test recon?

Bug bounty recon focuses on breadth — finding as many subdomains and entry points as possible. Penetration test recon is more targeted, often with a defined scope and timeline. Both follow the same fundamental workflow phases.