Tuesday, October 8, 2024
HomeInformation GatheringNetwork Reconnaissance to get Target Subdomains and IP's with recon-ng & Netcraft

Network Reconnaissance to get Target Subdomains and IP’s with recon-ng & Netcraft

Published on

Recon-ng is an advanced Web Reconnaissance tool written in Python. It is an effective tool in which open-source web-based Network reconnaissance can be led rapidly and all together.

Recon-ng is a total system and makes it simple for even the most up to the date of Python designers to contribute. Every module is a subclass of the “module” class.

The “module” class is an altered “cmd” mediator furnished with inherent usefulness that gives basic interfaces to basic errands, for example, institutionalizing yield, associating with the database, making the web asks for, and overseeing API keys.

- Advertisement - EHA
Recon-ng has a look and feels similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance.

Reconnaissance with recon-ng

Step 1: To launch type recon-ng in Terminal

root@kali:~# recon-ng 

To list all the commands type [recon-ng][default] > help

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step2: To get the subdomains of a domain we need to add the domain to workspace first.

recon-ng][default] > workspaces
Manages workspaces

Usage: workspaces [list|add|select|delete]

[recon-ng][default] > workspaces add vulnweb.com

Step3: Netcraft need to be added to pull the subdomains of a domain.

[recon-ng][vulnweb.com] > use netcraft
[recon-ng][vulnweb.com][netcraft] > set source vulnweb.com

Step4: Now you should type “Run” to get the list of subdomains associated with the domain.

[recon-ng][vulnweb.com][netcraft] > run

Step5: To get a clear list view type “show hosts

[recon-ng][vulnweb.com][netcraft] > show hosts
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step6: Next you need to find the IP address associated with that by using “resolve“.

[recon-ng][vulnweb.com][netcraft] > use resolve

Step7: It shows list of options and we need to select “recon/hosts-hosts/resolve

recon-ng][vulnweb.com][netcraft] > use recon/hosts-hosts/resolve

Step8: To find the country, longitude and location you should use “freegeoip

[recon-ng][vulnweb.com][resolve] > use freegeoip
[recon-ng][vulnweb.com][freegeoip] > run

Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Step9: To extract the findings as a report use “use report”

[recon-ng][vulnweb.com][freegeoip] > use report
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft
Network Reconnaissance to get Target Subdomains of domain and IP's with Recon-ng & Netcraft

Therefore, all the hard work has been done. It is simple and takes little more than a few minutes.

  • Author: Tim Tomes
  • License: GPLv3

Also Read:

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Badge and CyberArk Announce Partnership to Redefine Privacy in PAM and Secrets Management

Partnership aims to help businesses eliminate vulnerable attack surfaces and provide a more streamlined...

LemonDuck Malware Exploiting SMB Vulnerabilities To Attack Windwos Servers

The attackers exploited the EternalBlue vulnerability to gain initial access to the observatory farm,...

Critical Automative 0-Day Flaws Let Attackers Gain Full Control Over Cars

Recent discoveries in the automotive cybersecurity landscape have unveiled a series of critical zero-day...

Likho Hackers Using MeshCentral For Remotely Managing Victim Systems

The Awaken Likho APT group launched a new campaign in June of 2024 with...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

AgentTesla Stealer Delivered Via Weaponized PDF and CHM Files

AgentTesla, a notorious information stealer, is observed spreading via CHM and PDF Files, which...

InSpy – Linkedin Information Gathering Tool for Penetration Testers

The objective of this Information Gathering tool is to extract Linkedin users based on...

scanless – A Pentesting Tool to Perform Anonymous open Port Scan on Target Websites

Network Penetration Testing determines vulnerabilities on the network posture by discovering Open ports, Troubleshooting...