Friday, November 1, 2024
HomeInformation GatheringNetwork Reconnaissance to get Target Subdomains and IP's with recon-ng & Netcraft

Network Reconnaissance to get Target Subdomains and IP’s with recon-ng & Netcraft

Published on

Malware protection

Recon-ng is an advanced Web Reconnaissance tool written in Python. It is an effective tool in which open-source web-based Network reconnaissance can be led rapidly and all together.

Recon-ng is a total system and makes it simple for even the most up to the date of Python designers to contribute. Every module is a subclass of the “module” class.

The “module” class is an altered “cmd” mediator furnished with inherent usefulness that gives basic interfaces to basic errands, for example, institutionalizing yield, associating with the database, making the web asks for, and overseeing API keys.

- Advertisement - SIEM as a Service
Recon-ng has a look and feels similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance.

Reconnaissance with recon-ng

Step 1: To launch type recon-ng in Terminal

root@kali:~# recon-ng 

To list all the commands type [recon-ng][default] > help

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step2: To get the subdomains of a domain we need to add the domain to workspace first.

recon-ng][default] > workspaces
Manages workspaces

Usage: workspaces [list|add|select|delete]

[recon-ng][default] > workspaces add vulnweb.com

Step3: Netcraft need to be added to pull the subdomains of a domain.

[recon-ng][vulnweb.com] > use netcraft
[recon-ng][vulnweb.com][netcraft] > set source vulnweb.com

Step4: Now you should type “Run” to get the list of subdomains associated with the domain.

[recon-ng][vulnweb.com][netcraft] > run

Step5: To get a clear list view type “show hosts

[recon-ng][vulnweb.com][netcraft] > show hosts
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step6: Next you need to find the IP address associated with that by using “resolve“.

[recon-ng][vulnweb.com][netcraft] > use resolve

Step7: It shows list of options and we need to select “recon/hosts-hosts/resolve

recon-ng][vulnweb.com][netcraft] > use recon/hosts-hosts/resolve

Step8: To find the country, longitude and location you should use “freegeoip

[recon-ng][vulnweb.com][resolve] > use freegeoip
[recon-ng][vulnweb.com][freegeoip] > run

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step9: To extract the findings as a report use “use report”

[recon-ng][vulnweb.com][freegeoip] > use report
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Therefore, all the hard work has been done. It is simple and takes little more than a few minutes.

  • Author: Tim Tomes
  • License: GPLv3

Also Read:

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

AgentTesla Stealer Delivered Via Weaponized PDF and CHM Files

AgentTesla, a notorious information stealer, is observed spreading via CHM and PDF Files, which...

InSpy – Linkedin Information Gathering Tool for Penetration Testers

The objective of this Information Gathering tool is to extract Linkedin users based on...

scanless – A Pentesting Tool to Perform Anonymous open Port Scan on Target Websites

Network Penetration Testing determines vulnerabilities on the network posture by discovering Open ports, Troubleshooting...