Skip to content

Reconnaissance

Executive Summary

Reconnaissance is the first phase of offensive security. It focuses on discovering targets, exposed services, technologies, and potential attack paths before exploitation.

Topics

  • Nmap — Host discovery, port scanning, service detection, scripts, and scan tuning.
  • Footprinting — Gathering information from exposed services, banners, shares, DNS, and public sources.
  • Content Discovery — Finding hidden directories, files, endpoints, virtual hosts, and web application paths.
  • Web Reconnaissance — Discovering subdomains, VHosts, technologies, WAFs, crawled paths, and exposed metadata.