Categories: Information Gathering

Network Reconnaissance to get Target Subdomains and IP’s with recon-ng & Netcraft

Recon-ng is an advanced Web Reconnaissance tool written in Python. It is an effective tool in which open-source web-based Network reconnaissance can be led rapidly and all together.

Recon-ng is a total system and makes it simple for even the most up to the date of Python designers to contribute. Every module is a subclass of the “module” class.

The “module” class is an altered “cmd” mediator furnished with inherent usefulness that gives basic interfaces to basic errands, for example, institutionalizing yield, associating with the database, making the web asks for, and overseeing API keys.

Recon-ng has a look and feels similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. However, it is quite different. Recon-ng is not intended to compete with existing frameworks, as it is designed exclusively for web-based open source reconnaissance.

Reconnaissance with recon-ng

Step 1: To launch type recon-ng in Terminal

root@kali:~# recon-ng

To list all the commands type [recon-ng][default] > help

Step2: To get the subdomains of a domain we need to add the domain to workspace first.

recon-ng][default] > workspaces
Manages workspaces

Usage: workspaces [list|add|select|delete]

[recon-ng][default] > workspaces add vulnweb.com

Step3: Netcraft need to be added to pull the subdomains of a domain.

[recon-ng][vulnweb.com] > use netcraft
[recon-ng][vulnweb.com][netcraft] > set source vulnweb.com

Step4: Now you should type “Run” to get the list of subdomains associated with the domain.

[recon-ng][vulnweb.com][netcraft] > run

Step5: To get a clear list view type “show hosts

[recon-ng][vulnweb.com][netcraft] > show hosts

Step6: Next you need to find the IP address associated with that by using “resolve“.

[recon-ng][vulnweb.com][netcraft] > use resolve

Step7: It shows list of options and we need to select “recon/hosts-hosts/resolve

recon-ng][vulnweb.com][netcraft] > use recon/hosts-hosts/resolve

Step8: To find the country, longitude and location you should use “freegeoip

[recon-ng][vulnweb.com][resolve] > use freegeoip
[recon-ng][vulnweb.com][freegeoip] > run

Step9: To extract the findings as a report use “use report”

[recon-ng][vulnweb.com][freegeoip] > use report

Therefore, all the hard work has been done. It is simple and takes little more than a few minutes.

  • Author: Tim Tomes
  • License: GPLv3

Also Read:

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Lumma Stealer Attacking Users To Steal Login Credentials From Browsers

Researchers observed Lumma Stealer activity across multiple online samples, including PowerShell scripts and a disguised…

20 hours ago

New ‘OtterCookie’ Malware Attacking Software Developers Via Fake Job Offers

Palo Alto Networks reported the Contagious Interview campaign in November 2023, a financially motivated attack…

20 hours ago

NjRat 2.3D Pro Edition Shared on GitHub: A Growing Cybersecurity Concern

The recent discovery of the NjRat 2.3D Professional Edition on GitHub has raised alarms in…

20 hours ago

Palo Alto Networks Vulnerability Puts Firewalls at Risk of DoS Attacks

A critical vulnerability, CVE-2024-3393, has been identified in the DNS Security feature of Palo Alto…

20 hours ago

Araneida Scanner – Hackers Using Cracked Version Of Acunetix Vulnerability Scanner

Threat Analysts have reported alarming findings about the "Araneida Scanner," a malicious tool allegedly based…

2 days ago

A Dark Web Operation Acquiring KYC Details TO Bypass Identity Verification Systems

A major dark web operation dedicated to circumventing KYC (Know Your Customer) procedures, which involves…

2 days ago