Reconnaissance
Analysis of your target before any action is taken, is like cleaning windshield before driving. The more you see, the less chaotic and more organised your attacks are
Basics
Section titled “Basics”We can recognize two elementary types of recon:
Includes gathering information about target without directly interacting with it. It could be fetching data from public services (e.g. wayback machine, DNS servers, public repos, social media).
Involves directly interacting with target and possibly leaving traces of our activity (logs). We can probe for open services, versions, hosts and more. By default this is really noisy and most of defenses recognize this activity as scanning, especially when requests go towards unintended services.
DRAFTS
Section titled “DRAFTS”Need to cover:
- Types of passive recon
- Types of active recon
- Tools overview
- Techniques overview
- Consider if to keep it here or separate by pages per technique
IDEA: Recon page - quick overview of everything so one can choose what do they need, subpages for more detailed descriptions on how to use particular tooling Repositories for tooling and documentation available in resources (the library of links and documents)