# External Recon and Enumeration Principles

## Core Principles

* **Passive vs. Active Reconnaissance:**
  * **Passive:** Gathering information without directly interacting with the target's systems (e.g., searching public databases, social media).
  * **Active:** Directly interacting with the target's systems (e.g., scanning ports, probing services).
* **Scoping:** Defining the boundaries of the engagement to avoid unintended consequences.
* **Information Gathering:** The primary goal is to collect as much relevant information as possible about the target.
* **Iterative Process:** Reconnaissance is not a one-time event; it's an ongoing process throughout the penetration test.
* **OSINT (Open-Source Intelligence):** Utilizing publicly available information to gather intelligence.

## **Key Data Points:**

* **IP Space:** Identifying the target's network ranges and ASNs.
* **Domain Information:** Discovering domain names, subdomains, DNS records, and registrars.
* **Schema Formats:** Understanding naming conventions for usernames, email addresses, and other identifiers.
* **Data Disclosures:** Finding publicly accessible documents, files, and other data that may contain sensitive information.
* **Breach Data:** Identifying compromised credentials and other leaked data.

## **Essential Techniques:**

* **DNS Enumeration:** Querying DNS servers to discover domain information.
* **Social Media Analysis:** Gathering information from social media platforms.
* **Website Analysis:** Examining the target's website for information and vulnerabilities.
* **Google Dorking:** Using advanced search operators to find specific information.
* **Credential Hunting:** Searching for leaked credentials in breach data sources.
* **Subdomain Enumeration:** Discovering subdomains associated with the target domain.
* **ASN lookups:** Discovering the owner of IP address blocks.

## **Key Tools:**

* **nslookup/dig:** For DNS queries.
* **whois:** For domain registration information.
* **BGP Toolkit:** For ASN and IP address information.
* **Shodan/Censys:** For discovering exposed devices and services.
* **Dehashed/HaveIBeenPwned:** For checking breach data.
* **Sublist3r/Amass:** For subdomain enumeration.
* **Trufflehog:** For finding secrets in code repositories.
* **Domaintools/Viewdns.info:** For domain information.

## **Ethical Considerations:**

* **Staying Within Scope:** Adhering to the agreed-upon boundaries of the engagement.
* **Obtaining Authorization:** Ensuring that you have explicit permission to perform reconnaissance and penetration testing.
* **Protecting Sensitive Information:** Handling any sensitive information that you discover responsibly.
* **Avoiding Unintended Harm:** Taking precautions to avoid disrupting the target's systems or services.
