By Jackson Godwin | TechTrain Academy | Cybersecurity Governance & VAPT Specialist📧 info@jacksontechnology.com
Sun Tzu wrote in The Art of War: 'Know your enemy and know yourself and you will not be imperiled in a hundred battles.' He wrote that in 500 BC — but it describes the most fundamental principle of modern penetration testing perfectly.
Before a professional penetration tester touches a single system, before they run a single scan, before they attempt a single exploit — they gather information. As much information as possible, from as many sources as possible, without the target ever knowing they are being studied.
This phase is called Reconnaissance. And the discipline of gathering intelligence from publicly available sources is called OSINT — Open Source Intelligence.
In this guide — Part 3 of the TechTrain Academy Practical Penetration Testing Series — I will teach you everything about reconnaissance and OSINT that professional penetration testers use in real engagements. From Google dorks to Shodan, from Maltego to theHarvester, from DNS enumeration to social media intelligence — by the end of this article, you will think like an attacker before you touch anything.
| ⚠️ LEGAL DISCLAIMER Reconnaissance and OSINT techniques in this guide use publicly available information. However, some techniques — such as active DNS enumeration — interact with target systems. Only perform active reconnaissance against systems you own or have explicit written permission to test. Passive OSINT on publicly available information is generally legal. If in doubt, contact Jackson Godwin at info@jacksontechnology.com.ng before proceeding. |
What is Reconnaissance and Why Does It Matter?
Reconnaissance is the first phase of every penetration testing engagement and every real-world cyber attack. It is the process of gathering as much information as possible about a target before attempting any active testing or exploitation.
Reconnaissance answers critical questions:
- What domains and subdomains does the target own?
- What IP addresses and network ranges are associated with the target?
- What technologies and software does the target use?
- Who are the key employees and what are their email formats?
- What has the target accidentally exposed to the internet?
- What vulnerabilities have been publicly disclosed about their technology stack?
- What information has the target leaked through job postings, social media, or public documents?
The more you know before attacking, the more focused, efficient, and successful your penetration test will be. Amateur hackers attack blindly. Professionals study first.
Passive vs Active Reconnaissance
| PASSIVE RECONNAISSANCE | ACTIVE RECONNAISSANCE |
| No direct contact with target systems | Direct interaction with target systems |
| Uses only publicly available information | Sends packets or requests to the target |
| Cannot be detected by the target | Can appear in target logs and IDS alerts |
| Examples: Google, WHOIS, Shodan, LinkedIn | Examples: Nmap, DNS zone transfer, web crawling |
| Always legal when using public sources | Requires explicit written authorization |
| Do this FIRST — always | Do this AFTER passive recon is complete |
Phase 1 — Passive Reconnaissance Tools and Techniques
Start here — gather as much intelligence as possible without touching the target:
1. WHOIS Lookup — Domain Ownership Information
WHOIS reveals who registered a domain, when it was registered, when it expires, and often contact information, name servers, and registrar details. This is always the first thing to check on a target domain.
| COMMAND: WHOIS domain lookup |
| whois target.com # What you get: # Registrant name and organization # Email address (sometimes redacted) # Registration and expiry dates # Name servers (reveals DNS provider) # Registrar information |
Also use online WHOIS tools: who.is, whois.domaintools.com, and whois.net for graphical interfaces with historical data.
2. DNS Enumeration — Mapping the Target's Infrastructure
DNS records reveal enormous amounts of information about a target's infrastructure — mail servers, web servers, subdomains, and more. Every DNS record type tells you something different:
| COMMAND: DNS record enumeration |
| # Look up all DNS records dig target.com ANY # Find mail servers (MX records) dig MX target.com # Find name servers dig NS target.com # Find IP address (A record) dig A target.com # Reverse DNS lookup (IP to hostname) dig -x 192.168.1.1 # Using host command host -a target.com |
| What DNS Records Reveal A records: Web server IP addresses. MX records: Email server provider (Microsoft Exchange? Google Workspace? — reveals email security). NS records: DNS provider. TXT records: Often contain SPF, DKIM, DMARC records — reveals email security configuration and sometimes verification tokens for third-party services. CNAME records: Reveals cloud services in use (Cloudflare, AWS, Azure). Each record type is a clue about the target's technology stack. |
3. Google Dorks — Finding Hidden Information
Google Dorks are advanced search operators that help you find information the target may not have intended to make public — exposed login pages, configuration files, sensitive documents, and more.
| COMMAND: Essential Google Dork operators |
| site:target.com # All indexed pages on the domain site:target.com filetype:pdf # Find PDF documents site:target.com inurl:admin # Find admin pages site:target.com inurl:login # Find login pages site:target.com "password" # Pages mentioning password site:target.com "config" # Configuration files intitle:"index of" site:target.com # Open directory listings site:target.com ext:sql # SQL database files site:target.com ext:env # Environment files (often contain API keys) site:target.com ext:bak # Backup files |
| Real World Impact of Google Dorks In professional penetration testing engagements, Google Dorks regularly reveal: exposed configuration files containing database credentials, backup files with source code, admin panels that should not be publicly accessible, sensitive documents accidentally uploaded to public servers, and API keys left in publicly accessible JavaScript files. Organizations are often shocked at what is discoverable through a few well-crafted Google searches. |
4. Shodan — The Search Engine for Internet-Connected Devices
Shodan is one of the most powerful OSINT tools available — it continuously scans the entire internet and indexes information about every device it finds. Think of it as Google, but for internet-connected systems, services, and devices.
Shodan can find: web servers, databases, industrial control systems, IoT devices, webcams, routers, and virtually any internet-connected device — along with the services, versions, and sometimes vulnerabilities associated with them.
| COMMAND: Using Shodan from the command line |
| # Install Shodan CLI sudo pip3 install shodan # Initialize with your API key (free account at shodan.io) shodan init YOUR_API_KEY # Search for a specific organization shodan search org:'Target Organization' # Find all web servers for a domain shodan search hostname:target.com # Get information about a specific IP shodan host 192.168.1.1 # Find all Apache servers in Nigeria shodan search 'apache country:NG' |
Also use the Shodan web interface at shodan.io for a graphical experience. A free account gives you limited searches — the paid version is worth investing in for serious penetration testing work.
5. theHarvester — Email and Subdomain Discovery
theHarvester is a pre-installed Kali Linux tool that gathers emails, subdomains, hosts, employee names, open ports, and banners from different public sources including search engines, PGP key servers, and Shodan.
| COMMAND: theHarvester commands |
| theHarvester -d target.com -b google # Search multiple sources theHarvester -d target.com -b google,bing,linkedin # Limit results and set source theHarvester -d target.com -l 200 -b all # Save results to HTML file theHarvester -d target.com -b all -f results.html # What you get: # Email addresses (reveals email format e.g. firstname.lastname@target.com) # Subdomains discovered # Hosts and IP addresses # Employee names from LinkedIn |
6. Subfinder — Subdomain Enumeration
Subdomains often reveal different parts of an organization's infrastructure — development servers, internal tools, staging environments, and forgotten systems. Subfinder is one of the most powerful subdomain discovery tools available.
| COMMAND: Subfinder subdomain enumeration |
Install subfinder sudo apt install subfinder -y # Basic subdomain enumeration subfinder -d target.com # Save results to file subfinder -d target.com -o subdomains.txt # Verbose output showing sources subfinder -d target.com -v # Common subdomains found: # mail.target.com, vpn.target.com, dev.target.com # staging.target.com, admin.target.com, api.target.com |
Phase 2 — Active Reconnaissance Tools
After exhausting passive sources, move to active reconnaissance — directly interacting with the target to gather more detailed information. Remember: only on authorized targets.
| 🔍 amass | Subdomain Enumeration & Attack Surface Mapping |
Amass is the most comprehensive attack surface mapping tool available. It combines passive DNS enumeration, certificate transparency logs, web scraping, and active DNS brute-forcing to build a complete map of a target's external attack surface. Basic command: amass enum -d target.com What you discover: Complete subdomain list, IP addresses, ASN information, certificate data, and a graph of how all discovered assets relate to each other |
| 🔍 dnsrecon | DNS Record Enumeration and Zone Transfer Testing |
| DNSrecon performs comprehensive DNS enumeration including all record types, zone transfer attempts, reverse DNS lookups, and DNS brute-forcing. Zone transfers — when misconfigured — can reveal the entire DNS structure of an organization. Basic command: dnsrecon -d target.com -t std What you discover: All DNS records, zone transfer results if misconfigured, reverse lookup results, and DNS brute-force findings. |
| 🔍 wafw00f | Web Application Firewall Detection |
| Before testing a web application, identify if a Web Application Firewall (WAF) is protecting it. WAFs can block your testing and alert the target. Knowing which WAF is in place helps you select appropriate testing techniques. Basic command: wafw00f https://target.com What you discover: WAF vendor and product identification. No WAF detected (easier testing). WAF detected (need to consider evasion techniques). |
| 🔍 whatweb | Web Technology Fingerprinting |
| WhatWeb identifies the technologies used by a website — CMS (WordPress, Joomla, Drupal), web frameworks, server software, analytics tools, and more. Each technology identified is a potential attack vector to research for vulnerabilities. Basic command: whatweb target.com What you discover: CMS type and version, web server software (Apache, Nginx, IIS), programming language, jQuery version, analytics tools, email addresses found in page source. |
Social Media OSINT — The Human Intelligence Layer
Organizations leak enormous amounts of useful information through social media, job postings, and professional networks. Here is what to look for:
LinkedIn Intelligence
- Employee names and job titles — reveals organizational structure and key targets for social engineering
- Technology mentioned in job descriptions — 'Experience with AWS, Kubernetes, and Splunk required' reveals their tech stack
- Recently hired IT staff — new employees in security roles may indicate recent incidents or security initiatives
- Former employees — may have insider knowledge and sometimes less loyalty to their former employer
Job Postings Intelligence
- Technology stack revealed — 'Must know CentOS 7, Apache 2.4, MySQL 5.7' tells you exactly what they run
- Security gaps revealed — 'Help us build our first SOC' tells you they have no monitoring yet
- Third-party vendors revealed — 'Experience with Salesforce, SAP, and Oracle required'
- Salary ranges reveal budget levels — which correlates with likely security investment
GitHub Intelligence
- Source code repositories — developers sometimes accidentally commit API keys, passwords, and internal hostnames
- Organization's repositories reveal technologies, frameworks, and sometimes internal infrastructure details
- Employee GitHub profiles — personal projects can reveal skill levels and sometimes work-related code
| COMMAND: GitHub scanning |
| Search GitHub for accidentally committed secrets # Go to: github.com/search # Search for API keys org:targetorg "api_key" org:targetorg "password" org:targetorg "secret_key" # Or use the tool trufflehog sudo pip3 install trufflehog trufflehog github --org=targetorg |
Putting It All Together — The Professional Reconnaissance Workflow
In a real penetration testing engagement, here is the complete reconnaissance workflow professional testers follow:
| COMMAND: Complete reconnaissance workflow |
| # PHASE 1: PASSIVE RECONNAISSANCE # 1. Domain and registration info whois target.com # 2. DNS enumeration dig target.com ANY dnsrecon -d target.com -t std # 3. Subdomain discovery subfinder -d target.com -o subdomains.txt amass enum -d target.com # 4. Email and employee discovery theHarvester -d target.com -b all -f harvest.html # 5. Google dorking # Search: site:target.com filetype:pdf # Search: site:target.com inurl:admin # 6. Shodan search shodan search org:'Target Organization' shodan search hostname:target.com # PHASE 2: ACTIVE RECONNAISSANCE # 7. Web technology fingerprinting whatweb target.com wafw00f https://target.com # 8. Network scanning (AUTHORIZED ONLY) sudo nmap -sV -sC target.com # 9. Full subdomain active enumeration amass enum -active -d target.com |
The OSINT Framework — Your Complete Reference
The OSINT Framework (osintframework.com) is a free online resource that maps every OSINT technique, tool, and source by category. It is an invaluable reference for professional penetration testers and OSINT investigators. Bookmark it now.
Key categories in the OSINT Framework relevant to penetration testing:
- Username Search — Find all accounts associated with a username across platforms
- Email Address — Verify email addresses, find associated accounts and breached credentials
- Domain Name — Comprehensive domain intelligence from multiple sources
- IP Address — Geolocation, ASN, abuse reports, and passive DNS data
- Social Networks — LinkedIn, Twitter, Facebook, Instagram intelligence techniques
- Telephone Numbers — Nigerian phone number lookup and carrier identification
- Business Records — Company registration data from CAC (Corporate Affairs Commission) Nigeria
Practical Exercise — Reconnaissance on a Test Target
For this exercise we will use a legitimate practice target — hackerone.com (a bug bounty platform that publicly invites security research). This is completely legal and authorized:
| Authorized Practice Target HackerOne.com actively invites security researchers to test their platform. This makes it a perfect legal practice target for learning reconnaissance techniques. Do NOT practice on Nigerian banks, government sites, or any organization without written permission. |
| COMMAND: Practice reconnaissance exercise |
| hackerone.com # Step 2: DNS enumeration dig hackerone.com ANY dnsrecon -d hackerone.com -t std # Step 3: Subdomain discovery subfinder -d hackerone.com # Step 4: Email harvesting theHarvester -d hackerone.com -b google,bing -l 100 # Step 5: Technology fingerprinting whatweb hackerone.com wafw00f https://hackerone.com # Document ALL whois findings in a text file # This is your reconnaissance report |
Documenting Reconnaissance Findings — Professional Standards
In professional penetration testing, documentation is as important as the technical work. Here is what your reconnaissance documentation should include:
- Target Overview — Organization name, domain(s), IP ranges, and scope boundaries
- DNS Infrastructure — All DNS records, name servers, mail servers, and subdomain map
- Technology Stack — Web servers, CMS, frameworks, databases, cloud providers identified
- Employee Information — Names, email addresses, roles (without storing unnecessarily personal data)
- Exposed Assets — Any accidentally exposed systems, files, or information found
- Third-Party Services — Payment processors, CDNs, cloud services, and SaaS tools in use
- Potential Attack Vectors — Initial assessment of the most promising areas to focus testing
- Sources Used — Every tool and source used, for reproducibility and legal documentation
| Jackson Godwin's Reconnaissance Tip In every VAPT engagement I conduct, I spend at least 20-30% of the total engagement time on reconnaissance. The more thorough your reconnaissance, the more focused and effective your later testing phases will be. I have found critical vulnerabilities purely from information gathered in the reconnaissance phase — before touching a single system. Never rush this phase. The intelligence you gather here shapes everything that follows. Questions? Email me directly: info@jacksontechnology.com.ng |
Conclusion — Intelligence is Power
Reconnaissance and OSINT are not just technical skills — they are a mindset. The professional penetration tester's mindset of systematic intelligence gathering, patient analysis, and methodical documentation before taking action.
Practice the techniques in this guide on authorized targets. Build your reconnaissance workflow until it becomes instinctive. Learn to find the information that organizations do not realize they have exposed.
In Part 4 of this series, we move to Burp Suite — the essential tool for web application penetration testing. If reconnaissance tells you WHAT is there, Burp Suite helps you find out HOW it can be broken.
Questions about this guide? Email Jackson Godwin directly at info@jacksontechnology.comng Enroll in TechTrain Academy for live, hands-on training with real lab environments.
| Learn Reconnaissance & OSINT at a Professional Level TechTrain Academy's Ethical Hacking & VAPT program covers reconnaissance, OSINT, and all penetration testing phases in a fully practical, hands-on lab environment. Train with real scenarios used in professional VAPT engagements. Enroll Now | Email: info@jacksontechnology@gmail.com.ng | Visit TechTrain Academy |
| Questions about this tutorial? 📧 info@jacksontechnology@gmail.com.g Jackson personally responds to student questions. Enroll in TechTrain Academy for full hands-on training with live instructor support. |
| ⬅ PREVIOUS Part 2: Nmap — Network Scanning | NEXT ➡ Part 4: Burp Suite — Web App Testing |
| About the Author Jackson Godwin is a Cybersecurity Governance & VAPT Specialist and founder of TechTrain Academy. With over 40 web and mobile application security assessments conducted across Nigerian financial institutions, government agencies, and enterprises, Jackson brings real-world penetration testing experience to every tutorial in this series. Questions? Email: info@jacksontechnology.com |
TAGS: OSINT ethical hacking Nigeria, reconnaissance penetration testing Nigeria, Google dorks hacking, Shodan tutorial Nigeria, theHarvester tutorial, passive information gathering, TechTrain Academy, info@jacksontechnology@gmail.com.ng