19 entries tagged “Recon”. Browse all tags
The whois quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Look up a domain, find who owns an IP, enumerate a netblock, pull name servers, read registration dates, query a registry directly, and route around a redacted or wrong-server answer with RDAP.
The Nikto quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real scan. Scan HTTP and HTTPS, hit odd ports, reach a vhost by Host header, tune out the noise, proxy through Burp, save a machine-readable report, and pull just the findings.
The dig quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Resolve A/AAAA, find MX and NS, read SPF and DMARC TXT, reverse-lookup an IP, query a specific resolver, trace delegation from the root, and test a zone transfer.
A practical Metasploit guide: install it, verify it, search modules, set options safely, validate findings with auxiliary checks, and keep a cheat sheet you will actually reuse.
The dnsenum quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull records and name servers, test a zone transfer, brute force subdomains, pick a resolver for split-horizon DNS, sweep netranges, grow a wordlist, and export XML for your notes.
A practical PowerView guide for authorized AD labs: load the module, enumerate users, groups, ACLs, and trusts from a domain-joined host, read the output, and understand the defenses that watch it.
The Wfuzz quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz paths, query and POST parameters, headers, cookies, and virtual hosts, filter custom-404 noise by size, brute a login with two markers, encode payloads on the fly, and proxy through Burp.
The smbmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. List shares over a null session, read the READ/WRITE flags honestly, recurse a share, pull and push files, pass the hash, and run an authorized remote command.
The RustScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Sweep all 65535 TCP ports in seconds, hand the open ones to Nmap for versions and scripts, scan a subnet or a file of hosts, fix too many open files, tune speed on a laggy link, and pull a greppable port list.
The hash-identifier quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Turn an unknown hash into the right hashcat -m mode or john --format, triage a mixed dump, read prefixes like $6$ and $2y$, break the MD5-vs-NTLM tie, and hand the type straight to a cracker.
The exiftool quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Dump every tag, pull GPS as decimal, surface hidden CTF fields, extract the embedded thumbnail, strip metadata before publishing, shift wrong timestamps, and batch a folder to CSV.
The CeWL quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Crawl an authorized site, build a wordlist from its own words, tune depth and length, harvest emails and document authors, rank by frequency, then feed hydra, john, and hashcat.
The Nmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Ping-sweep a subnet, scan all 65535 ports, fingerprint service versions, run safe NSE scripts, scan UDP, get past a blocked ping, and save output for your notes.
The DNSRecon quick reference: modes, flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull standard records, test a zone transfer, brute force subdomains, reverse an IP range, walk a DNSSEC zone, pin a resolver, and save CSV/JSON you can diff.
The WPScan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Enumerate users, find vulnerable plugins and themes, pull exposed config backups, run an authorized login attack, tune detection-mode noise, and parse the JSON with jq.
The Amass quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real recon situation. Enumerate subdomains passively then actively, load API keys for real coverage, brute force names, pull JSON with jq, find related domains by WHOIS/ASN/CIDR, diff the stored database, and validate before you scan.
The testssl.sh quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Confirm old protocols are off, read the certificate chain, run every named-vuln check, list ciphers, scan STARTTLS mail ports, and pin one backend behind a load balancer.
The theHarvester quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pull subdomains from certificate transparency, scrape hosts and emails from search engines, resolve and validate leads with DNS, page a noisy source, wire in API keys, save JSON for jq, and run it in Docker.
The sslscan quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Scan a non-standard TLS port, upgrade a STARTTLS mail service, set SNI on a shared host, check for Heartbleed, read the cipher and certificate output, and diff a hardening change over time.
Type to search · / or Ctrl+K to open · ↑↓ to move · Enter to open · Esc to close
