[Hack3rcon]

Hello,
I need experts ideas. Consider a domain like "example.com" and when a hacker want to recognize and find information about this target then which tools he\she using? Which steps he\she did?
I find a tool like https://dnsdumpster.com/, but I'm thankful if others show me useful information.

Thank you.

[slothic]

What you mean is reconnaissance in which you gather as much information about the target as you can.

There are two different types of recon: Active Recon & Passive Recon.


Footprinting
Footprinting is used to gather as much information as you can about the target system and network.
Things you want to find:

• DNS information
  
• Whois Record
  
• Operating System Used
  
• IP addresses
  
• Employee Emails/Numbers
  

One way in which you can find out about the targets operating system is through fingerprinting. A useful tool for this is nmap in which you can use the following command:

Code:

nmap -sV -O <target-ip>

-sV: Probe open ports to determine service/version info
-O: Enable OS detection

Make sure too look at the FIREWALL/IDS EVASION AND SPOOFING section in the nmap help section which will be useful if you're doing some non-legal test .

Once we have this information this allows for further research about the target such as CVE's for the services. Also if you can not get the server operating system from this you can use  the dev console to look at the network which can give you some information when you make a GET request to the site or going to www.thetarget.com/dgjb2gi3oneg which will produce an error however sometimes the error can give you useful information.


This is just the tip of the iceberg for recon, if you wish to get into ethical hacking as a job these skill will need to be essential to making doing write up a lot easier. I might drop some tutorials on sinisterly if anyone is interested and I'll add more details with visual examples then.