HTTP/HTTPS:
Reconnaissance
Subdomain brute force, passive recon, cert logs, and dorks
Certificate Transparency Enumeration
Enumerate subdomains and infrastructure by querying Certificate Transparency logs, leveraging publicly recorded TLS certificates to map attack surface during recon.
Google Dork Reconnaissance
Leverage advanced Google search operators to uncover exposed files, misconfigs, login portals, and sensitive data indexed on target web infrastructure.
Passive Web Reconnaissance
Techniques for gathering web infrastructure intel without direct interaction—DNS records, WHOIS, archived content, metadata, and OSINT sources.
Subdomain Bruteforce
Enumerate hidden subdomains via wordlist-based bruteforce using tools like gobuster, ffuf, and amass to expand attack surface during recon.
Web reconnaissance is the passive and semi-passive information gathering phase before you send a single request to the target. Certificate transparency logs (crt.sh), DNS records, WHOIS data, and search engine results reveal subdomains, IP ranges, and infrastructure details without alerting the target.
Google dorking with site-specific operators uncovers exposed files, login pages, directory listings, and error messages indexed by search engines. The Wayback Machine shows old versions of sites that may contain removed endpoints, leaked paths, or outdated technologies with known vulnerabilities. Shodan and Censys reveal open ports, SSL certificate details, and HTTP response headers across the target's IP space.
Technology stack identification through HTTP headers, JavaScript libraries, and response patterns tells you what you are attacking before active enumeration begins. This phase feeds directly into targeted wordlists and attack strategies.