Reconnaissance and Enumeration
Reconnaissance and enumeration
This domain turns a company name into a map of reachable assets, then into users, shares, services and versions. The exam separates passive collection that never touches the target from active probing that does, and expects you to match tool and protocol to question.
Passive first
Passive sources generate no traffic to the client: WHOIS/RDAP, public DNS records (A, MX, NS, TXT for SPF and DMARC), certificate transparency logs such as crt.sh that leak subdomains and internal hostnames in SANs, Shodan and Censys for exposed services, theHarvester, Recon-ng and Maltego for emails and hosts, Google dorks (site:, filetype:, inurl:), job postings and GitHub commits for leaked keys. Browsing the client's website or resolving names through their own servers makes the activity active - know which side of the line you are on.
Active DNS and host enumeration
Attempt a zone transfer (dig AXFR), brute-force subdomains against a wordlist, reverse-resolve discovered ranges, map ASNs. Use Nmap for host discovery, service and version detection, default NSE scripts and UDP scans; UDP services worth probing include SNMP 161, NTP 123 and TFTP 69.
Protocol enumeration
- SMB 445 - null sessions and share listing (smbclient -L, enum4linux-ng) reveal users, groups and open shares.
- LDAP 389/636 - anonymous bind and base-DN discovery expose directory structure.
- NFS 2049 - showmount -e lists exported paths and permitted clients.
- SMTP 25 - VRFY and EXPN can confirm valid addresses.
- SNMP - default community strings public/private; snmpwalk returns interfaces, processes, software and sometimes accounts.
Web enumeration
Pull robots.txt and sitemap.xml, run content discovery, and fingerprint server and WAF from response headers, cookie names and error pages. TLS certificate SANs often disclose additional hostnames.
Worked example
Scope is example.com. crt.sh returns dev.example.com, which resolves into a cloud range the client did not list. Nmap shows only 443, and the certificate SAN lists internal hostnames; the zone transfer is refused. The correct action is to stop active testing on that host, ask whether it is in scope, and record the internal names as intelligence for later. Discovery does not expand scope.
Traps
Assuming a discovered subdomain is authorized. Forgetting IPv6. Scanning production loudly during business hours. Reading an open port as an exploitable service. Failing to record your source IP, which breaks log correlation with the client's SOC.