Saturday, December 9, 2023

Network Reconnaissance to get Target Subdomains and IP’s with recon-ng & Netcraft

Recon-ng is an advanced Web Reconnaissance tool written in Python. It is an effective tool in which open-source web-based Network reconnaissance can be led rapidly and all together.

Recon-ng is a total system and makes it simple for even the most up to the date of Python designers to contribute. Every module is a subclass of the “module” class.

The “module” class is an altered “cmd” mediator furnished with inherent usefulness that gives basic interfaces to basic errands, for example, institutionalizing yield, associating with the database, making the web asks for, and overseeing API keys.

Recon-ng has a look and feels similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance.

Reconnaissance with recon-ng

Step 1: To launch type recon-ng in Terminal

root@kali:~# recon-ng 

To list all the commands type [recon-ng][default] > help

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step2: To get the subdomains of a domain we need to add the domain to workspace first.

recon-ng][default] > workspaces
Manages workspaces

Usage: workspaces [list|add|select|delete]

[recon-ng][default] > workspaces add vulnweb.com

Step3: Netcraft need to be added to pull the subdomains of a domain.

[recon-ng][vulnweb.com] > use netcraft
[recon-ng][vulnweb.com][netcraft] > set source vulnweb.com

Step4: Now you should type “Run” to get the list of subdomains associated with the domain.

[recon-ng][vulnweb.com][netcraft] > run

Step5: To get a clear list view type “show hosts

[recon-ng][vulnweb.com][netcraft] > show hosts
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step6: Next you need to find the IP address associated with that by using “resolve“.

[recon-ng][vulnweb.com][netcraft] > use resolve

Step7: It shows list of options and we need to select “recon/hosts-hosts/resolve

recon-ng][vulnweb.com][netcraft] > use recon/hosts-hosts/resolve

Step8: To find the country, longitude and location you should use “freegeoip

[recon-ng][vulnweb.com][resolve] > use freegeoip
[recon-ng][vulnweb.com][freegeoip] > run

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step9: To extract the findings as a report use “use report”

[recon-ng][vulnweb.com][freegeoip] > use report
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Therefore, all the hard work has been done. It is simple and takes little more than a few minutes.

  • Author: Tim Tomes
  • License: GPLv3

Also Read:

Website

Latest articles

WordPress POP Chain Flaw Exposes Over 800M+ Websites to Attack

A critical remote code execution vulnerability has been patched as part of the Wordpress...

Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts

Hackers target email accounts because they contain valuable personal and financial information. Successful email...

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles