Scribd
Upload
6 views1 page

Reconnaissance Techniques for Pentesting

The document outlines key concepts and a step-by-step plan for conducting reconnaissance in penetration testing, emphasizing the importance of systematic public information gathering through both passive and active methods. It details essential commands for WHOIS, DNS queries, and tools like theHarvester, along with ethical considerations and deliverables required for documentation. Additionally, it provides exam tips and reminders for effective evidence management and reporting.

Uploaded by

Aya Labrigui
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
6 views1 page

Reconnaissance Techniques for Pentesting

The document outlines key concepts and a step-by-step plan for conducting reconnaissance in penetration testing, emphasizing the importance of systematic public information gathering through both passive and active methods. It details essential commands for WHOIS, DNS queries, and tools like theHarvester, along with ethical considerations and deliverables required for documentation. Additionally, it provides exam tips and reminders for effective evidence management and reporting.

Uploaded by

Aya Labrigui
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Study Card — Chapter 2 & Lab 01: Reconnaissance / Foot

Printable A4 — Created: 2025-11-09 14:36

Core Concepts (Memorize) Lab 01 — Step Plan (Follow in order)


• Footprinting = systematic public info gathering (phase• 1)
1 Setup: create ~/ceh_lab/lab01 ; [Link] ;
of pentest). recon_notes.md
• Passive vs Active: passive = OSINT (no contact); active =
• 2) Passive OSINT: WHOIS -> whois_out.txt
direct probes (may be logged).
• 3) DNS enum: dig A / MX / NS -> dig_*.txt
• Deliverables: whois, dig outputs, theHarvester report,
ping/traceroute, recon_summary.md. • 4) theHarvester: collect emails/subdomains ->

• Ethics: permission first, timestamp outputs, non- theh_out.html


destructive actions.
• 5) Google dorks: site:[Link] filetype:pdf ;
• Key risks: open zone transfer, exposed emails, public docs
save URLs
with secrets.
• 6) Ping & traceroute: ping_out.txt,

High-Value Commands (quick) trace_out.txt

WHOIS: whois [Link] > whois_out.txt • 7) Save evidence: timestamp filenames, [Link]
DIG (DNS): archive
dig ANY [Link] > dig_any.txt ; dig +short ns [Link]

Zone transfer: dig axfr [Link] @[Link] # only if allowed


• 8) Produce recon_summary.md (template: overview,
theHarvester: theharvester -d [Link] -b google -l 300 -f theh_out.html
findings, DNS, risks, next steps)
Ping / Traceroute:ping -c 4 <ip> > ping_out.txt ; traceroute <ip> > trace_out.txt
Web snapshot: wget -r -l 1 [Link] Recon Summary — Must include
Nikto (web scan): nikto -h [Link] -o [Link]
• Target overview (domain, primary IPs, NS)
• Passive findings (subdomains, emails, public docs) with eviden
• DNS records summary (A, MX, NS, SOA)
• Network observations (ping/RTT, traceroute hops)
• Risk rating & top 3 next steps (scanning plan)
• List of evidence files and timestamps

Exam Tips / Quick Reminders


• • If asked: contrast passive vs active and give examples.
• • Always cite files as evidence (whois_out.txt, dig_any.txt, theh_out.html).
• • Do NOT claim a vulnerability from passive data alone; label 'possible'.
Source: Module01 CEH — Chapter 2 & Lab01 (Printable)
• • Save outputs with timestamps: out_YYYYMMDD_HHMM.xml / .txt
• • Keep a one-page cheat-sheet and script snippets ready.

You might also like