Thursday, February 27, 2025
HomeInformation GatheringNetwork Reconnaissance to get Target Subdomains and IP's with recon-ng & Netcraft

Network Reconnaissance to get Target Subdomains and IP’s with recon-ng & Netcraft

Published on

SIEM as a Service

Follow Us on Google News

Recon-ng is an advanced Web Reconnaissance tool written in Python. It is an effective tool in which open-source web-based Network reconnaissance can be led rapidly and all together.

Recon-ng is a total system and makes it simple for even the most up to the date of Python designers to contribute. Every module is a subclass of the “module” class.

The “module” class is an altered “cmd” mediator furnished with inherent usefulness that gives basic interfaces to basic errands, for example, institutionalizing yield, associating with the database, making the web asks for, and overseeing API keys.

Recon-ng has a look and feels similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance.

Reconnaissance with recon-ng

Step 1: To launch type recon-ng in Terminal

root@kali:~# recon-ng 

To list all the commands type [recon-ng][default] > help

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step2: To get the subdomains of a domain we need to add the domain to workspace first.

recon-ng][default] > workspaces
Manages workspaces

Usage: workspaces [list|add|select|delete]

[recon-ng][default] > workspaces add vulnweb.com

Step3: Netcraft need to be added to pull the subdomains of a domain.

[recon-ng][vulnweb.com] > use netcraft
[recon-ng][vulnweb.com][netcraft] > set source vulnweb.com

Step4: Now you should type “Run” to get the list of subdomains associated with the domain.

[recon-ng][vulnweb.com][netcraft] > run

Step5: To get a clear list view type “show hosts

[recon-ng][vulnweb.com][netcraft] > show hosts
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step6: Next you need to find the IP address associated with that by using “resolve“.

[recon-ng][vulnweb.com][netcraft] > use resolve

Step7: It shows list of options and we need to select “recon/hosts-hosts/resolve

recon-ng][vulnweb.com][netcraft] > use recon/hosts-hosts/resolve

Step8: To find the country, longitude and location you should use “freegeoip

[recon-ng][vulnweb.com][resolve] > use freegeoip
[recon-ng][vulnweb.com][freegeoip] > run

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step9: To extract the findings as a report use “use report”

[recon-ng][vulnweb.com][freegeoip] > use report
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Therefore, all the hard work has been done. It is simple and takes little more than a few minutes.

  • Author: Tim Tomes
  • License: GPLv3

Also Read:

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Lotus Blossom Hacker Group Uses Dropbox, Twitter, and Zimbra for C2 Communications

The Lotus Blossom hacker group, also known as Spring Dragon, Billbug, or Thrip, has...

Squidoor: Multi-Vector Malware Exploiting Outlook API, DNS & ICMP Tunneling for C2

A newly identified malware, dubbed "Squidoor," has emerged as a sophisticated threat targeting government,...

Unpatched Vulnerabilities Attract Cybercriminals as EDR Visibility Remains Limited

Cyber adversaries have evolved into highly organized and professional entities, mirroring the operational efficiency...

Threat Actors Attack Job Seekers of Fortune 500 Companies to Steal Personal Details

In Q3 2024, Cofense Intelligence uncovered a targeted spear-phishing campaign aimed at employees working...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

AgentTesla Stealer Delivered Via Weaponized PDF and CHM Files

AgentTesla, a notorious information stealer, is observed spreading via CHM and PDF Files, which...

InSpy – Linkedin Information Gathering Tool for Penetration Testers

The objective of this Information Gathering tool is to extract Linkedin users based on...

scanless – A Pentesting Tool to Perform Anonymous open Port Scan on Target Websites

Network Penetration Testing determines vulnerabilities on the network posture by discovering Open ports, Troubleshooting...