Reconnaissance, Enumeration, and OSINT
Reconnaissance, Enumeration, and OSINT
This domain tests passive and active information gathering and the discipline to turn raw data into targets. CPTS expects you to use OSINT for domains, people, infrastructure, and leaked secrets, then enumerate services without blind brute force.
Core rules
- Passive first: WHOIS, DNS records, certificate transparency (crt.sh), ASN/IP ownership, Shodan/Censys, GitHub and paste-site searches, metadata in documents, and search-engine dorks. Record sources.
- Build a DNS map: A, AAAA, MX, TXT, NS, SOA, CNAME, zone-transfer attempts, reverse PTR, and virtual-host discovery. Wildcard DNS can make every subdomain resolve; verify with a random label.
- Active enumeration should be service-specific: Nmap version scripts, SMB null sessions, LDAP anonymous bind, SNMP community strings, FTP anonymous access, and web content discovery with ffuf or feroxbuster.
- Validate every lead. A 403 is not 'no access'; try path variations, vhosts, methods, and headers. A login page may hide an API.
- Keep a findings register with source, confidence, and next action. OSINT is only useful if it becomes an actionable host, credential, or technology.
Worked example
Target is example.com. crt.sh returns dev.example.com and vpn.example.com; both resolve. A random subdomain also resolves, indicating wildcard DNS, so you filter results by comparing response sizes. You fingerprint dev.example.com as nginx and run feroxbuster with a small wordlist; /api/ returns 401 while /api/v1/users returns 200 with a JSON error. That error reveals a framework and a parameter name. You then test the parameter, not the whole site. The reasoning is: discover, de-wildcard, fingerprint, then enumerate narrowly.
Traps
Launching a large brute force before checking wildcards, ignoring UDP (SNMP, DNS), missing IPv6, trusting certificate SANs as complete, forgetting vhosts on shared IPs, and not checking source code or JavaScript for endpoints and secrets.