HTTP/HTTPS:

Reconnaissance

Subdomain brute force, passive recon, cert logs, and dorks

4 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

4 guides

Certificate Transparency Enumeration

Enumerate subdomains and infrastructure by querying Certificate Transparency logs, leveraging publicly recorded TLS certificates to map attack surface during recon.

Mar 28, 2026 • 4 min read

Google Dork Reconnaissance

Leverage advanced Google search operators to uncover exposed files, misconfigs, login portals, and sensitive data indexed on target web infrastructure.

Mar 28, 2026 • 3 min read

Passive Web Reconnaissance

Techniques for gathering web infrastructure intel without direct interaction—DNS records, WHOIS, archived content, metadata, and OSINT sources.

Mar 28, 2026 • 6 min read

Subdomain Bruteforce

Enumerate hidden subdomains via wordlist-based bruteforce using tools like gobuster, ffuf, and amass to expand attack surface during recon.

Jan 23, 2026 • 4 min read

Web reconnaissance is the passive and semi-passive information gathering phase before you send a single request to the target. Certificate transparency logs (crt.sh), DNS records, WHOIS data, and search engine results reveal subdomains, IP ranges, and infrastructure details without alerting the target.

Google dorking with site-specific operators uncovers exposed files, login pages, directory listings, and error messages indexed by search engines. The Wayback Machine shows old versions of sites that may contain removed endpoints, leaked paths, or outdated technologies with known vulnerabilities. Shodan and Censys reveal open ports, SSL certificate details, and HTTP response headers across the target's IP space.

Technology stack identification through HTTP headers, JavaScript libraries, and response patterns tells you what you are attacking before active enumeration begins. This phase feeds directly into targeted wordlists and attack strategies.