Back to Details

recon

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Recon — Penetration Testing Reconnaissance

Recon — 渗透测试侦察

Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.
Cross-references: 
osint-recon
for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. 
web-pentest
for the next stage once recon has produced an attack surface map and an authorized target list. 
owasp-audit
for source-code review when you have access to the target's code.
针对授权目标执行结构化侦察，将发现整理为可执行的攻击面地图。
交叉参考：
osint-recon
用于更深入的开源情报调查（人员、组织、历史数据）——本技能侧重于主动/被动目标映射，osint-recon则侧重于更广泛的调查；二者天然互补。
web-pentest
用于侦察生成攻击面地图和授权目标列表后的下一阶段。
owasp-audit
用于在获取目标代码后的源代码审查。

Authorization Check

授权检查

Before running any commands, confirm:
  1. The user has written authorization for the target (pentest engagement, bug bounty program, CTF/lab environment)
  2. The target is within the defined scope
If authorization is unclear, ask before proceeding. Never assume authorization.
在运行任何命令前，确认：
  1. 用户拥有针对目标的书面授权（penetration test项目、bug bounty program、CTF/实验环境）
  2. 目标在定义的范围内
如果授权不明确，先询问再进行操作。切勿假设已获得授权。

Methodology

方法论

Phase 1: Passive Recon

阶段1：被动侦察

Gather information without touching the target directly.
DNS enumeration:
  • Run 
    dig any $ARGUMENTS
    for A, AAAA, MX, TXT, NS, CNAME records
  • Attempt zone transfer: 
    dig axfr @ns-server $ARGUMENTS
  • Enumerate subdomains via certificate transparency: 
    curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" | jq -r '.[].name_value' | sort -u
WHOIS and registration: Run 
whois $ARGUMENTS
for registrant, nameserver, and creation date info.
Search engine dorking: Use targeted queries — 
site:
, 
inurl:
, 
filetype:
, 
intitle:
— to find exposed pages, documents, and admin panels.
Technology fingerprinting: Identify frameworks, CMS, server software, and JavaScript libraries from public-facing pages.
Public code repositories: Search GitHub/GitLab for the target's org name, domain, API keys, or internal paths.
Historical data: Check the Wayback Machine for old endpoints, removed pages, and configuration files.
在不直接接触目标的情况下收集信息。
DNS枚举：
  • 运行
    dig any $ARGUMENTS
    获取A、AAAA、MX、TXT、NS、CNAME记录
  • 尝试区域传输：
    dig axfr @ns-server $ARGUMENTS
  • 通过证书透明度枚举子域名： 
    curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" | jq -r '.[].name_value' | sort -u
WHOIS与注册信息： 运行
whois $ARGUMENTS
获取注册人、域名服务器和创建日期信息。
搜索引擎dorking： 使用定向查询——
site:
、
inurl:
、
filetype:
、
intitle:
——查找暴露的页面、文档和管理面板。
技术指纹识别： 从公开页面识别框架、CMS、服务器软件和JavaScript库。
公共代码仓库： 在GitHub/GitLab中搜索目标的组织名称、域名、API密钥或内部路径。
历史数据： 查看Wayback Machine获取旧端点、已移除页面和配置文件。

Phase 2: Active Recon (explicit authorization only)

阶段2：主动侦察（仅在获得明确授权后）

Port scanning:
bash
nmap -sC -sV -oN scan-results.txt $ARGUMENTS
Start with top 1000 ports. Expand to full range (
-p-
) if needed. Use 
-Pn
if the host appears down but is in scope.
Service enumeration: Based on open ports, probe for version info and default configurations.
Web content discovery:
  • Directory bruting with gobuster, feroxbuster, or dirsearch
  • Virtual host enumeration
  • API endpoint discovery (check 
    /api/
    , 
    /v1/
    , 
    /graphql
    , 
    /swagger.json
    )
SSL/TLS analysis: Run 
testssl.sh
or 
sslyze
to check for weak ciphers, expired certificates, and misconfigurations.
端口扫描：
bash
nmap -sC -sV -oN scan-results.txt $ARGUMENTS
先扫描前1000个端口。如有需要，扩展到全端口范围（
-p-
）。如果主机显示离线但在范围内，使用
-Pn
参数。
服务枚举： 根据开放端口，探测版本信息和默认配置。
Web内容发现：
  • 使用gobuster、feroxbuster或dirsearch进行目录爆破
  • 虚拟主机枚举
  • API端点发现（检查
    /api/
    、
    /v1/
    、
    /graphql
    、
    /swagger.json
    ）
SSL/TLS分析： 运行
testssl.sh
或
sslyze
检查弱密码套件、过期证书和配置错误。

Phase 3: Analysis

阶段3：分析

Correlate all findings. Identify the most promising attack vectors and prioritize by:
  1. Severity of potential impact
  2. Likelihood of exploitation
  3. Exposure level (internet-facing vs. internal)
关联所有发现。确定最有潜力的攻击向量，并按以下优先级排序：
  1. 潜在影响的严重程度
  2. 被利用的可能性
  3. 暴露级别（面向互联网 vs 内部）

Output Format

输出格式

Produce a structured recon report:
markdown
undefined
生成结构化侦察报告：
markdown
undefined

Recon Report

Recon Report

Target: [target]

Target: [target]

Scope: [confirmed scope]

Scope: [confirmed scope]

Date: [date]

Date: [date]

Passive Findings

Passive Findings

FindingDetailsRelevance
FindingDetailsRelevance

Subdomains Discovered

Subdomains Discovered

  • [list]
  • [list]

Technologies Detected

Technologies Detected

  • [list with versions where identified]
  • [list with versions where identified]

Active Findings

Active Findings

PortServiceVersionNotes
PortServiceVersionNotes

Attack Surface Summary

Attack Surface Summary

[Prioritized list of interesting findings with risk assessment]
[Prioritized list of interesting findings with risk assessment]

Recommended Next Steps

Recommended Next Steps

[Ordered list of what to investigate further]
undefined
[Ordered list of what to investigate further]
undefined

Boundaries

边界限制

  • Stay within the defined scope — never scan adjacent or out-of-scope systems
  • Rate-limit aggressive scans to avoid disruption
  • Log all commands run for the engagement record
  • If you discover evidence of active compromise by a third party, alert the user immediately
  • Refuse requests targeting systems without explicit authorization
  • Refuse requests for mass scanning of unrelated targets
  • 严格在定义的范围内操作——切勿扫描相邻或超出范围的系统
  • 对攻击性扫描进行速率限制，避免造成中断
  • 记录所有执行的命令，用于项目记录
  • 如果发现第三方正在主动入侵的证据，立即通知用户
  • 拒绝针对无明确授权系统的请求
  • 拒绝针对无关目标的大规模扫描请求

References

参考资料

  • PTES (Penetration Testing Execution Standard)
  • OWASP Testing Guide
  • Bug Bounty Methodology (jhaddix/tbhm)
  • PTES（Penetration Testing Execution Standard）
  • OWASP Testing Guide
  • Bug Bounty Methodology (jhaddix/tbhm)