In the world of Ethical Hacking, CTF Challenges and Bug Bounty hunting, the Reconnaissance or Recon, stage is the most important. The more information that’s available, the more target vectors you can identify, then the easier it is to find bugs and or bounties In this post I will cover the difference between Active and Passive Reconnaissance.
For the sake of readability (and typing) I will just reference Ethical Hacking, CTF Challenges and Bug Bounty hunting as just “Cyber”.
What is Recon?
In the world of IT Cyber, the terminology that used has very close links to the US military phrases. “Target”, “Attacker”, “Advanced Persistent Threats”, “Attack Vector”, “Detection and Response”, etc. These are all US military terms and “Recon” is just another US military term. Recon is short for “Reconnaissance“. Which means “to conduct a preliminary and especially an exploratory survey of a target”.
In Cyber there are two approaches to this, Active and Passive. So lets take a look at each approach.
Active Recon
This is the more direct approach. So Directly scanning down the systems for weaknesses. As the target is scanned downed, this is a very visible reconnaissance and the scans will appear in the targets security log files. This direct approach is probably the fastest of the two in order to gather information but the most risky.
If taking this approach I highly recommend you use a VPS so save your ISP from causing you problems.
Passive Recon
This is the indirect approach. Where you query other sources to get information and do not engage directly with the target. This is so not to raise any flags on the target side and keeps you hidden from security logs.
Which should you use?
Passive, always use “Passive Recon” as the first step. The very nature of the activity of Recon is not to alert the target to what you are doing. Therefore, a few blasts of nmap or nuceli and the target WAF will quickly know something is up and will start to block your IP addresses.
If you are pen-testing and have full permission to blast away at the network, then go for it. But even if pen-testing, it would be beneficial to see what information can be gathered by Passive Recon, and should be the first step.
Tools for Reconnaissance
There are many great tools we can use for Active or Passive Reconnaissance, and some of the Greatest tools are even gathered together into great Frameworks. These lists I compiled are not comprehensive, but an example of what can be done with each approach.
Active Recon Tools
Below you will find a list of tools that are active tools or scanners. Some are more noisy than others but all will leave something in security logs of the target. Luckily each of them has a rate limiter so the target is not destroyed with traffic from your scans. So be sure to use rate limits if it’s listed in the Scope of the bug bounty.
- Nuceli – One of the best scanner, its based on templates but there are lots available.
- gospider – A web page spider/crawler written in go. Really fast.
- gobuster – A web fuzzer (amongst other things) written in go, one of the best.
- nmap – Port scanner, legendary in status.
- wpscan – Scan a WordPress framework of a site
- gxss – Checking reflecting Parameters in a URL.
Passive Recon Tools
Tthese tools are a great start for enumerating your targets without appearing in the targets security log files.
- subfinder – Fast passive subdomain enumeration tool.
- waybackurl – Grab urls from waybackmachine (archive.org)
- smap – grab port information from shodan.io
- builtwith – Find out what websites are Built With
Frameworks
Most of the tools above are in the frameworks below. If you are serious about Bug Bounties, then I would highly recommend that you move to the methodologies provided by these frameworks as soon as you can. Starting with ReconFTW and then on to Axiom. You wont regret it and you can set up some real automation.
- ReconFTW – automates the entire process of reconnaissance
- Axiom – A dynamic infrastructure framework that can spread workloads over multiple VPS. Your very own botnet.
Wrap Up
Cyber is all about knowledge, but the deeper you dig into it, the more you realise that you know nothing. Active and Passive Reconnaissance are essential skills to have and to know the difference between.
If you have any comments or updates you will find me over on twitter.
Comments are closed.