Scribd
Upload
4 views2 pages

Shosubgo Recon Methodology Overview

The document outlines a multi-step reconnaissance methodology for cybersecurity, detailing tools and techniques for both active and passive recon. It emphasizes the importance of understanding the target's assets, including web applications, APIs, and infrastructure, to identify vulnerabilities. The document also highlights the need for continuous mapping of assets to detect changes and discover new attack surfaces.

Uploaded by

mainaudy12
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
4 views2 pages

Shosubgo Recon Methodology Overview

The document outlines a multi-step reconnaissance methodology for cybersecurity, detailing tools and techniques for both active and passive recon. It emphasizes the importance of understanding the target's assets, including web applications, APIs, and infrastructure, to identify vulnerabilities. The document also highlights the need for continuous mapping of assets to detect changes and discover new attack surfaces.

Uploaded by

mainaudy12
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

//////////////////////////////////////////

step 1 ( finished) : recon methodology


//////////////////////////////////////////
burpsuite scan
gospider + subscraper
google dork : (site:*.[Link])
amass ( without apis )( remaining )
subfinder ( with apis)
github-subdomains
Shosubgo
cloud scraping : [Link] ( skipped
)
[Link]
master/Hunting%20Certificates%20%26%[Link]

dns brute forcing (skiped)

combined everything in onelist then finding 200 subdomains


dnmasscan ( port scanning) (skip)

//////////////////////////////////////////
step 2 : fundamentals of recon
//////////////////////////////////////////
active and passive recons

Active : drectory brutforcing, dns bruteforcing actively hitting the targets


( touching the asset)

Passive : use 3rd party api to hit the target

wide recon: top level domains , subdomains , acquasation ( regularly ) ( deep or


shuttle depends)

narrow recon :app functionality , directory brute forcing , api endpoints

recon over time : mapping assets again and again everytime and check for changes

exceptions : finding unique and less known bugs or going deep in bug so much that u
become goat at it
//////////////////////////////////////////////////////////////////
step 3: How To Do Recon : introduction to Recon
//////////////////////////////////////////////////////////////////////
Recon is something we do to expand our attack surface

A web or mobile app is just the surface

git repos , apis . frameworks , underlying infrastructure , development tools ,


directories , subdomains

learn about target , what exactly we can hack , find forgotten things , additional
endpoints to escalate bug , find new features , old features

=============================================================================
LEARN THE Target
======================================================================
TRY PRESSING ALL BUTTONS AND LEARN ABOUT IT WHICH ENDPOINT HITS WHAT , WHICH
ENDPOINTS WORKS WHAT ETC ..
//////////////////////////////////////////
step 4 : blogs
//////////////////////////////////////////

You might also like