Skip to main content

Web Applications Penetretion Testing. Stage 1: Reconnaissance

Cover image

Article Metadata

Ecosystem Fit​

This page mirrors the original Medium article into the 1200km.com Docusaurus ecosystem. The original article flow, images, screenshots, infographics, and technical blocks are preserved from the export.

Unveil the first steps in securing web applications by exploring the essential techniques and tools for effective reconnaissance​

Introduction​

In the intricate world of web application penetration testing, the reconnaissance stage serves as the cornerstone upon which all subsequent security efforts are built. Often overlooked in favor of more direct attack techniques, this initial phase is where the foundation of a successful penetration test is laid. By gathering critical information about the target system, penetration testers can map out a strategic approach that not only identifies potential vulnerabilities but also avoids common pitfalls that could render their efforts ineffective.

Reconnaissance, or ‘recon’ as it is commonly known in the cyber security community, involves a careful examination of the application’s surface to glean insights about its infrastructure, functionalities, and potential weaknesses. This stage isn’t about launching attacks, but rather about understanding and documenting every piece of relevant information that can be used to tailor subsequent penetration strategies. Whether you’re a seasoned security professional or a novice in the field, mastering the art of reconnaissance is a prerequisite for any successful web application penetration test.

In this post, we will dive into the tools and techniques essential for effective reconnaissance, illustrating how thorough initial research can pave the way for deeper insights and more effective security measures in later stages of penetration testing.

Article image

The information in this blog post is for educational and informational purposes only and is not intended as legal advice. The techniques discussed are meant for ethical use by professionals with proper authorization. The author assumes no responsibility for any misuse of the information contained herein or any resulting consequences. Users are advised to comply with applicable laws and conduct all activities responsibly.

Table of Contents​

  • Introduction

  • Domain and Subdomain Information

  • IP Address Ranges,WHOIS,DNS and Network Information

  • Email Addresses and Contacts

  • Public-Facing Technologies and Frameworks

  • Directory and File Enumeration

  • Reconnaissance Stage Report

1. Domain and Subdomain Information​

  • Surface Area Mapping: Understanding the full scope of the target’s domain structure is essential for mapping out the attack surface. Subdomains often host different applications and services, which might have different security postures compared to the main domain.

  • Vulnerability Identification: Each subdomain can potentially expose vulnerabilities or misconfigurations that are not present in the main domain. By comprehensively mapping all domains and subdomains, testers can identify more points of entry and weaknesses.

  • Infrastructure Insights: Subdomains can reveal how an organization structures its IT infrastructure. For instance, separate subdomains might be used for different business functions such as internal communications (intranet.company.com), customer-facing applications (shop.company.com), or development environments (dev.company.com). This insight can help in understanding the priority and sensitivity of different systems.

  • Scope of Testing: In penetration testing, clearly defining the scope of the engagement is vital to ensure that all testing activities are authorized and within legal bounds. Identifying all domains and subdomains helps in setting clear boundaries and expectations for the testing process.

  • Third-party Service Detection: Subdomains often point to external services or third-party hosted environments. Identifying these can help in assessing security risks associated with third-party vendors and cloud services.

  • Historical Analysis: Sometimes, subdomains are outdated or no longer in active use but still accessible over the internet. These can provide an easy target for attackers if not properly secured or decommissioned.

Recommended Tools :​

OWASP Amass**:**is an open-source tool for in-depth domain reconnaissance, asset discovery, and network mapping, widely used in penetration testing to identify a target’s external infrastructure.

theHarvester:is an open-source reconnaissance tool for gathering domain-related data, including emails, subdomains, and IPs. Widely used in penetration testing and OSINT, it aggregates information from public sources, helping map a target’s external footprint and reveal potential vulnerabilities.

Sublist3r:An open-source reconnaissance tool for discovering subdomains associated with a target domain. Widely used in penetration testing and OSINT, it aggregates data from multiple public sources, helping map an organization’s online footprint and uncover potential vulnerabilities.

**Censys:**a comprehensive cybersecurity platform, offers an expansive view of the internet’s infrastructure, providing security professionals with the tools needed to identify, analyze, and respond to vulnerabilities across global networks.

Hunter.iois a tool for finding and verifying professional email addresses linked to specific domains, widely used for lead generation and OSINT by gathering publicly available contact information.

2. IP Address Ranges, DNS, WHOIS and Network Information​

In the reconnaissance stage of a security assessment, mapping IP addresses, IP ranges, and Autonomous System Numbers (ASNs) serves as a critical step in revealing the linked infrastructure of a target. This process helps to understand the target’s network size, structure, and the scope of its digital presence. Here’s a detailed explanation of this step and its purpose:

Purpose​

Map IP addresses and ranges: Identifying the IP addresses and ranges associated with a target allows security professionals to delineate the network boundaries of an organization. This is crucial for understanding which parts of the network are accessible from the internet and might be susceptible to attacks.

Reveal linked infrastructure: By mapping the IP ranges, you can uncover how network segments are organized and potentially identify critical infrastructure, such as data centers, cloud services, and third-party services that are integrated into the target’s network.

ASN mapping: Each internet network is associated with an ASN that helps route traffic within and between networks. Understanding a target’s ASN provides insights into their internet service providers and can reveal the network paths that data takes to and from the target, which is important for both security and performance analyses.

Recommended Tools :​

**Basic Command Line Tools for Network Exploration:**Ping, Netdiscover, Whois, nslookup:

Shodan: is a search engine for internet-connected devices, enabling users to discover exposed servers, IoT devices, webcams, and industrial systems, often used in cybersecurity to identify potential vulnerabilities.

Nmap: Nmap (Network Mapper) is an open-source tool used for network discovery and security auditing, allowing users to scan for open ports, identify services, and detect operating systems on target systems.

**Censys:**a comprehensive cybersecurity platform, offers an expansive view of the internet’s infrastructure, providing security professionals with the tools needed to identify, analyze, and respond to vulnerabilities across global networks.

**DNSdumpster:**is a free online tool that allows users to find DNS records for domains, helping them visualize a domain’s DNS map. It is widely used in the initial stages of penetration testing to perform DNS reconnaissance.

  • Usage:

  • Visit the Website: Go tohttps://dnsdumpster.com/.

  • Enter the Domain: Input the domain you’re interested in researching into the search bar.

  • Analyze the Results: After submitting the domain, the site will generate a report that includes DNS records, a domain map, and other relevant information. Review these details to understand the domain’s DNS setup and identify areas that might warrant further investigation.

  • Download the Report: For offline analysis, you can download the DNS map and other data presented.

3. Email Addresses and Contacts​

Purpose: Discover company emails and contact information for potential usernames or login identifiers.

Recommended Tools:

theHarvester:is an open-source reconnaissance tool for gathering domain-related data, including emails, subdomains, and IPs. Widely used in penetration testing and OSINT, it aggregates information from public sources, helping map a target’s external footprint and reveal potential vulnerabilities.

Hunter.io: Finds professional emails and employee information.

LinkedIn: Useful for finding employee names and positions.

4. Public-Facing Technologies and Frameworks​

Purpose: Identify the technology stack, including frameworks, servers, CMS, and JavaScript libraries.

Recommended Tools:

Wappalyzer: Browser extension to identify technologies on web pages.

Very good and powerfull but not free.

BuiltWith: Analyzes the tech stack and integrations used by websites.

WhatWeb: Command-line tool for tech stack fingerprinting.

5. Directory and File Enumeration​

Purpose: Discover hidden directories and files on the target web server.

Recommended Tools :​

Dirbuster: Brute-forces directories and files using wordlists.

Gobuster: Fast directory and file brute-forcer in Go.

SecLists: Repository of wordlists

Web Application Penetration Testing: Reconnaissance Stage Report​

Project Information:

  • Client Name:[Client Name]

  • Project Date:[Date]

  • Lead Tester:[Lead Tester’s Name]

1. Domain and Subdomain Information

  • Main Domain:

  • Subdomains:

  • Historical Domains/Subdomains:

2. IP Address Ranges and Network Information

  • IP Addresses:

  • Network Topology Diagram:

  • ASN Information:

3. DNS and WHOIS Information

  • DNS Records:

  • A Records:

  • MX Records:

  • CNAME Records:

  • TXT Records:

  • WHOIS Data:

4. Email Addresses and Employee Contacts

  • Key Contact Emails:

  • Employee Details:

  • Names:

  • Roles:

  • Contact Information:

5. Public-Facing Technologies and Frameworks

  • Web Server Technologies:

  • Content Management Systems (CMS):

  • Client-side Technologies:

  • JavaScript Libraries:

  • CSS Frameworks:

6. Security Configurations

  • SSL/TLS Certificates:

  • Security Headers:

  • Cookies Settings:

7. Third-party Services and Integrations

  • External Services:

  • APIs Used:

8. Directory and File Enumeration

  • Unlinked Directories:

  • Sensitive Files:

Summary and Initial Findings:

  • [Provide a concise summary of the reconnaissance findings and any potential security issues identified.]

Recommendations for Next Stages:

  • [Provide recommendations based on the data gathered during the reconnaissance stage.]

Good luck!​

1200km@gmail.com