> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/reconnaissance.md).

# Reconnaissance

Pentesting reconnaissance methodology for attack surface mapping, subdomain enumeration, web fuzzing, Nmap scanning, and technology fingerprinting.

Reconnaissance is the first phase of a penetration test. The goal is to map the target attack surface, identify exposed services, discover subdomains, and fingerprint web technologies.

This section covers practical reconnaissance techniques used during penetration tests, CTF assessments, and external attack surface reviews.

## Reconnaissance Workflow

1. Identify live hosts and exposed services.
2. Enumerate open ports and service versions.
3. Discover directories, files, parameters, and hidden web resources.
4. Enumerate subdomains, DNS records, and public infrastructure.
5. Fingerprint web technologies, frameworks, CMS, servers, and versions.
6. Send public-source research and external OSINT work to the dedicated Hacking Tools OSINT hub.

## Reconnaissance Techniques

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-eye" style="color:$primary;">:eye:</i></h3></td><td><h4>Nmap</h4></td><td>Nmap reconnaissance notes for port scanning, service detection, NSE scripts, host discovery, firewall evasion, and vulnerability scanning.</td><td><a href="/reconnaissance/nmap.md">Nmap</a></td></tr><tr><td><h3><i class="fa-folder-open" style="color:$primary;">:folder-open:</i></h3></td><td><h4>Web Fuzzing</h4></td><td>Web fuzzing methodology for discovering hidden directories, files, extensions, parameters, and exposed resources with tools such as Gobuster and Wfuzz.</td><td><a href="/reconnaissance/web-fuzzing.md">Web Fuzzing</a></td></tr><tr><td><h3><i class="fa-earth-europe" style="color:$primary;">:earth-europe:</i></h3></td><td><h4>Subdomains</h4></td><td>Subdomain enumeration techniques for discovering public DNS records, certificate transparency entries, indexed hosts, and exposed infrastructure.</td><td><a href="/reconnaissance/subdomains.md">Subdomains</a></td></tr><tr><td><h3><i class="fa-fingerprint" style="color:$primary;">:fingerprint:</i></h3></td><td><h4>Web Profiling</h4></td><td>Web profiling techniques for identifying technologies, frameworks, CMS, servers, libraries, and exposed versions on a target website.</td><td><a href="/reconnaissance/web-profiling.md">Web Profiling</a></td></tr><tr><td><h3><i class="fa-google" style="color:$primary;">:google:</i></h3></td><td><h4>Google Dorking</h4></td><td>Google Dorking techniques for finding indexed sensitive files, exposed panels, backups, leaks, and public information during reconnaissance.</td><td><a href="/reconnaissance/google-dorking.md">Google Dorking</a></td></tr></tbody></table>

### Recommended Tools

* [Nmap](/reconnaissance/nmap.md) for port scanning, service detection, NSE scripts, and firewall evasion.
* [Web fuzzing](/reconnaissance/web-fuzzing.md) tools such as Gobuster and Wfuzz for discovering directories, files, and parameters.
* [Subdomain enumeration](/reconnaissance/subdomains.md) with DNS queries, certificate transparency, Google Dorks, and public datasets.
* [Web profiling](/reconnaissance/web-profiling.md) with WhatWeb, Wappalyzer, and BuiltWith to identify the target technology stack.
* [Google Dorking](/reconnaissance/google-dorking.md) for finding indexed sensitive files, exposed panels, backups, and public information.
* [OSINT and Research Tools](/hacking-tools/osint.md) for emails, leaks, metadata, phone numbers, and public identity correlation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/reconnaissance.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.