Reconnaissance cheatsheet

Resolve domain records and validates DNS functionality.

Identify authoritative name servers for a domain.

Retrieves mail server information, useful for email attack surface mapping.

Attempt a DNS zone transfer to dump all DNS records if misconfigured.

Perform basic DNS resolution using the system resolver.

Quickly resolve DNS records with concise output.

Passively discover subdomains using known data sources.

Actively enumerate subdomains using DNS brute force and scraping.

Perform passive-only subdomain discovery to reduce noise.

Identify web technologies such as frameworks, CMS, and server software.

Detect client- and server-side technologies used by a web application.

Retrieve HTTP headers to inspect server behavior and security controls.

Fetch web content while ignoring TLS certificate validation errors.

Brute-force directories and files to uncover hidden web content.

Brute-force subdomains via DNS resolution.

Fast fuzzing of URL paths to discover hidden endpoints.

Fuzz subdomains to identify additional virtual hosts.

Retrieve domain registration data and ownership metadata.

Collect emails, hosts, and subdomains from public sources.

Identify corporate email address patterns and known emails.
hunter.io

Search certificate transparency logs for related subdomains.
crt.sh

Find internet-facing systems associated with an organization.
shodan search "org:ExampleCorp"

Enumerate exposed services and certificates across the internet.
censys search example.com

Historical and current DNS intelligence.
securitytrails.com

Harvest email addresses associated with a domain.

Reputation and risk indicators for email addresses.
emailrep.io

Check if an S3 bucket is publicly accessible.

Determine the identity and permissions of the current AWS credentials.

List accessible Google Cloud projects for the authenticated account.

Enumerates Azure subscriptions tied to the current credentials.

Automatically screenshot discovered web services for quick visual triage.

Capture a screenshot of a single web target.

Discover live hosts on the local network by sending ARP requests; fast and noisy but very accurate on LANs.

Perform ARP-based discovery across a subnet to identify active IPs and MAC addresses.

Conduct a ping sweep to identify which hosts are alive without scanning ports.

Use ARP requests instead of ICMP for host discovery, effective on local networks.

Scan all 65,535 TCP ports and reports only open ones for full service coverage.

Run default NSE scripts and performs service/version detection on open ports.

Perform a stealth SYN scan while skipping host discovery, useful when ICMP is blocked.

Run vulnerability detection scripts against discovered services.

Scan the most common UDP ports to identify exposed UDP services.

List SMB shares without authentication if anonymous access is allowed.

Enumerate users, shares, and domain info via SMB and RPC.

Query RPC services anonymously for user and domain information.

Attempt to dump SNMP data using the default public community string.

Perform automated SNMP enumeration and configuration checks.

Capture wireless traffic and identifies nearby access points and clients.

Detect WPS-enabled access points and their configuration.

Passive recon should be exhausted before active scanning when possible.
Always record negative results, absence of exposure is still signal.