Stage 1 / 7 · Understand the target
Reconnaissance
Target selection, public exposure, asset discovery, and the intelligence that makes an intrusion possible.
53 readings · Guides can appear in more than one stage.
Understanding Reconnaissance
Reconnaissance is the preparation in which an adversary learns enough about a target to choose an approach. The information may come from public sources, interactions with exposed services, or earlier knowledge of the organization. The goal is to reduce uncertainty about who to target, which systems are reachable, and where a useful weakness might exist.
Typical activities
- Identify public domains, internet-facing systems, technologies, and organizational relationships.
- Research people, roles, suppliers, and public information that could support targeting or a convincing pretext.
- Assess exposed services and potential weaknesses before choosing an entry route.
Example: A public job advertisement reveals a technology in use, while an exposed service confirms that it is reachable. Together, those observations can guide a later attempt; neither observation establishes that an intrusion occurred.
Passive research may leave no trace in the target’s own logs. Active scanning can produce network or application events, but legitimate monitoring can look similar. Discovery inside an already compromised environment serves a different purpose from pre-intrusion reconnaissance.
Defender’s question: What can an outsider learn about us, and which changes in exposure or scanning deserve investigation?
Guides and articles by Andrey 53
Shodan , guide how you can find everything!
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 1
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Hostname/domain name scanning · IP address scanning.
Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 2
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: SCAN TECHNIQUES · -sS : TCP SYN Scan.
Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 3
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: PORT SPECIFICATION AND SCAN ORDER · -p <port ranges> : Specify Ports to Scan.
Mastering Nmap: A Comprehensive Guide to Network Exploration and Security Auditing. Part 4. Scripts
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
OWASP Amass Project guide
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Run Amass under Passive or Active Configuration.
Sublist3r. Your Essential Tool for Subdomain Enumeration
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
theHarvester: Your Essential Tool for OSINT and Reconnaissance in Cybersecurity
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Mastering the Basics: Essential CLI Tools for Reconnaissance in Penetration Testing
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Censys for Enhanced Cybersecurity Insight
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Mastering DirBuster: A Strategic Approach to Uncovering Hidden Web Assets
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Unlocking Web Intelligence: A Deep Dive into WhatWeb
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Advanced Scanning Options.
Web Applications Penetretion Testing. Stage 1: Reconnaissance
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 5. Directory and File Enumeration · Web Application Penetration Testing: Reconnaissance Stage Report.
Mastering Burp Suite Vulnerability Scanner
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Tool Overview: Burp Suite Automatic Vulnerability Scanner · Running and Using the Automatic Vulnerability Scanner in Burp Suite.
Nikto: Uncovering Web Server Vulnerabilities with an Open-Source Scanner
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
OWASP ZAP: A Comprehensive Guide to Web Application Security Testing
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Basic Automated Scan · For ZAP to capture traffic and run scans effectively, configure your browser to use ZAP as a proxy.
Web Applications Penetretion Testing. Stage 2: Scanning and Vulnerability Assessment
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Scanning Techniques · 1. Network/ports Scanning.
The Basic Toolkit for Penetration Testing
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Reconnaissance and OSINT Tools · Vulnerability Scanning and Enumeration.
Metasploit modules guide. Auxiliary
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 1. Scanners · 4. Vulnerability Scanners.
Tools by MITRE ATT&CK Guide
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Reconnecense · Active Scanning.
SpiderFoot Deep Dive: Installation, Scans, and Practical Use Cases
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Running Scans: Targets, Profiles, and Modules.
Reinventing Recon: Nmap Meets ChatGPT
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: B — Machine-readable summary (`scan_summary` JSON).
AI-Driven Pentesting at Home: Using HexStrike-AI for Full Network Discovery and Exploitation
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: How I Used Gemini + HexStrike-AI on Kali Linux to Scan, Enumerate, and Exploit My Own Network · Phase 2: Enumeration & Service Detection.
AI-Driven Web Application Pentesting with HexStrike-AI
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Integrating Shodan with HexStrike-AI Using Gemini-CLI
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: A Practical Guide to AI-Driven External Reconnaissance and Vulnerability Analysis · 3. Internet Exposure (High).
HexStrike + Cursor (MCP): From Single Target → Full Subnet Compromise (Lab PT Walkthrough)
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
HexStrike + Cursor for OSINT: From One Email to a Full Exposure Map
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 5) Real report (PUBLIC / REDACTED): Exposure & Correlation Report · Data Breach Exposure.
Active Directory Penetration Testing
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Phase 1: Reconnaissance and Network Discovery · Initial Reconnaissance.
AI-Driven Black Box Active Directory Penetration Testing
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Phase 2: Active Directory Discovery via SMB Enumeration · Phase 3: User Enumeration.
ADCS ESC8 Attack: Certificate-Based Domain Compromise — Complete Guide
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Step 0.1: Initial Reconnaissance — Port Scanning · User Enumeration Techniques.
A Complete Cloud Penetration Testing Walkthrough
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Phase 1: Initial Reconnaissance — Mapping the Attack Surface · Port Scanning: Finding Open Doors.
AI-Assisted Web and Cloud Penetration Testing with Cursor + MCP HexStrike and Burp Suite MCP.
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Web Application Enumeration: Choosing the Right Approach · Cloud Enumeration: Using GCP APIs.
Black-Box Kubernetes Penetration Testing Playbook
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Phase 0: Reconnaissance · What is Reconnaissance?.
One-Prompt AI-Powered Black-Box Kubernetes Penetration Test
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Example: Network Reconnaissance · Stage 0: Initial Reconnaissance.
GCP Penetration Testing: A Step-by-Step Attack Guide
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 1. Reconnaissance · Port Scanning.
The Complete Guide to AI-Driven Penetration Testing: Cursor, MCP, and the Modern PT Workflow
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 5.1 Reconnaissance (Recon) · 5.2 Scanning and Enumeration (Scan).
CTI Research: Handala Hack Group (aka Handala Hack Team)
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
CTI Research: Sandworm / APT44
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: February 2022 (Cyclops Blink Public Exposure + Wiper Wave) · Risk: Battlefield messaging exposure.
CTI Research: MuddyWater/Seedworm (Mango Sandstorm)
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network
Defender reconnaissance of adversary infrastructure, not evidence that the adversary scanned a victim.
Read: Pivot Type 2: Passive DNS — The History Book of the Internet · What Passive DNS Is.
AI in Offensive Operations: How Threat Actors Use Artificial Intelligence
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: AML.TA0002 — Reconnaissance.
Malicious Activity as a Statistical Signal: Anomaly Detection Engineering
Defensive support: use rate and frequency anomalies to investigate scanning; baseline legitimate monitoring activity.
Read: Frequency / Rate.
CTI Research: Kubernetes & Cloud-Native Threat Landscape
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 4.4 RBAC Hardening: Minimize Service Account Token Exposure.
APT41 Targeting Pharmaceutical Sector: Log4Shell to Domain Compromise
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: 5.1 Reconnaissance — T1596.003, T1596.005, T1592.002, T1589.002, T1595.002 · AD Enumeration from Linux — T1087.002.
Attack Playbook — Operation DragonRx
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Phase 0: Reconnaissance · 0.1 Passive Recon (simulated — no real external footprint in lab).
CTI Kill Chain: An Analyst Guide With Real-World Evidence
The reconnaissance examples distinguish targeting inference from directly observed preparation.
Read: 1. Reconnaissance and Precursors · Example 1: APT1 victimology supports deliberate target selection.
CTI-Led Defensive Strategy for a Cellular Provider (Case Study)
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: View 1: Public and customer-facing exposure · Detection theme 2: telecom core reconnaissance and subscriber-data access.
Comprehensive Cyber Intelligence Research: Attacks Against Embedded Systems, Hardware, Firmware…
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Cyberattacks on Big Pharma and Its Ecosystem: Threat Actors, Attack Surfaces, TTPs, and Defensible Lessons
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
OSINT Field Guide — Cyber Knowledge
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Passive reconnaissance · Active reconnaissance.
Red Team Field Guide — Cyber Knowledge
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Read: Module 2 — Reconnaissance and attack-surface mapping · Passive vs. active reconnaissance.
AI-Driven Offensive Security — 1200km
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
HexStrike AI Penetration Testing Guide — 1200km
Use the target-discovery, exposure, or campaign-preparation sections; keep internal post-access discovery separate.
Authoritative external resources
Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:
Defensive focus: Review exposed services and public information; distinguish external reconnaissance from discovery after access.
Methods across stages
Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.
Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.