terminal TRYHACKME PRACTICAL LEARNING & NMAP WORKFLOWS

Reconnaissance & Surface Enumeration

Passive reconnaissance (WHOIS, DNS) vs active surface enumeration (port sweeps, web fuzzing with ffuf).

Overview

Reconnaissance & Surface Enumeration is the initial phase of any cybersecurity evaluation. It involves systematically discovering all assets, domain names, network ranges, open ports, and application frameworks associated with an authorized target scope. Thorough reconnaissance dictates the success of subsequent security testing.

Core Concepts

Passive Reconnaissance: Gathering information through publicly accessible databases, DNS registries, WHOIS records, and search engine indices without sending packets directly to target servers.
Active Enumeration: Interacting directly with target network infrastructure via port scans, web directory fuzzing, and service queries.
DNS Record Types: A (IPv4), AAAA (IPv6), MX (Mail exchange), TXT (Verification & SPF), NS (Name servers), and CNAME (Aliases).
Web Technology Fingerprinting: Identifying CMS platforms, server technologies, frameworks, and web server software from response headers and page structures.

Tools & Requirements

Whois, Dig, Nmap, ffuf, WhatWeb, and cURL.

BASH // TOOL INSTALLATIONAPT

$ sudo apt update && sudo apt install -y whois dnsutils whatweb ffuf nmap

Commands & Practical Examples

1. WHOIS Domain & ASN Registration Query

Query registration data, netblocks, and authoritative registrar details:

BASH // DOMAIN REGISTRATIONWHOIS

$ whois example.com

2. Authoritative DNS Records Inspection

Query DNS nameservers for all available records without verbose commentary:

BASH // DNS QUERYDIG

$ dig example.com ANY +noall +answer
$ dig example.com MX +short

3. Web Technology Fingerprinting

Extract server banners, frameworks, cookie configurations, and JavaScript libraries:

BASH // WEB FINGERPRINTINGWHATWEB

$ whatweb http://192.168.1.10

4. Active Web Surface Fuzzing

Enumerate exposed administrative portals, development endpoints, and configuration files:

BASH // DIRECTORY ENUMERATIONFFUF

$ ffuf -w /usr/share/wordlists/dirb/common.txt -u http://192.168.1.10/FUZZ -mc 200,301

Practical Workflow

Domain & Scope Validation: Confirm scope boundaries (target domain, wildcards, CIDR ranges).
Passive Intelligence: Run WHOIS and DNS queries to identify associated nameservers and mail hosts.
Host & Port Discovery: Run Nmap host discovery followed by TCP/UDP sweeps.
Web Surface Discovery: Fingerprint running web servers with WhatWeb and fuzz endpoints with ffuf.
Asset Matrix Creation: Synthesize all discoveries into an attack surface inventory table.

Common Mistakes & Troubleshooting

Scope Creep: Accidentally scanning third-party infrastructure (e.g. cloud providers, CDNs, or payment gateways) hosted alongside the target.
Ignoring Non-Standard Ports: Restricting web enumeration to ports 80 and 443 misses internal administrative portals running on ports 8080, 8443, 8000, or 3000.

Security Considerations & Scoping

Passive reconnaissance generates no traffic to target infrastructure. Active enumeration, however, generates log records across firewalls and web servers. Always ensure written authorization covers all active scanning ranges.