ankur@sec:~$

$ ./recon-yourself.sh

Recon yourself in 30 minutes

Do what an attacker would do first - on your own domain. Type it once below and every command updates.

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

Prefer clicking? Use the attack surface lookup. Want it all at once? One line or one script. Keep a text file open. For every step, write down anything you didn't expect - that's your attack surface list.

01 · subdomains from certificates passive

Every certificate ever issued is public. Any name here that you don't recognise is either forgotten or unknown attack surface.

# crt.name (certificate transparency search)

$ curl -s "https://crt.name/v1/search?apex={{target}}" | grep -oiE '([a-z0-9_*-]+\.)*{{target}}' | sort -u

# more sources, saved to a file (subfinder)

$ subfinder -d {{target}} -silent -o subdomains.txt

needs:subfinderinstall ↗ - not installed? the command will fail with "command not found"

Look for: staging, dev, test, old, admin, vpn, jenkins, grafana. → A02

02 · which ones are alive? active · light

Turns names into running apps, with titles, servers and detected technologies.

# httpx

$ httpx -l subdomains.txt -silent -sc -title -server -td

needs:httpxinstall ↗ - not installed? the command will fail with "command not found"

Look for: login pages you didn't know about, default "Welcome to nginx" pages, old frameworks. → A02

03 · what do your servers say about themselves? active · light

# version headers

$ curl -sI https://{{target}} | grep -iE '^(server|x-powered-by|x-aspnet-version|x-aspnetmvc-version|x-generator):'

# missing security headers

$ curl -sI https://{{target}} | grep -iE '^(strict-transport-security|content-security-policy|x-content-type-options|referrer-policy):'

Any version number is a free CVE search for an attacker. → version tags

04 · what has the internet already indexed? passive

# Shodan (free account needed)

$ shodan search hostname:{{target}}

needs:Shodaninstall ↗ - not installed? the command will fail with "command not found"

Look for: open database ports, SSH, admin panels, old versions. Shodan saw them before you did. → A02

05 · old URLs that may still work passive

# all archived URLs

$ curl -s "https://web.archive.org/cdx/search/cdx?url={{target}}/*&fl=original&collapse=urlkey" | sort -u > urls.txt

# only URLs with parameters

$ grep '?' urls.txt | sort -u

# old API versions and interesting files

$ grep -iE '/v1/|/api/|swagger|\.json|\.env|\.bak|admin' urls.txt

Old endpoints often lack the checks added later. → A01, A05

06 · files that should never be public active · light

# exposed git folder (should be 404)

$ curl -s -o /dev/null -w '%{http_code} ' https://{{target}}/.git/HEAD

# exposed env file (should be 404)

$ curl -s -o /dev/null -w '%{http_code} ' https://{{target}}/.env

# public API docs

$ for p in swagger/index.html swagger.json openapi.json api-docs; do echo "$p $(curl -s -o /dev/null -w '%{http_code}' https://{{target}}/$p)"; done

A 200 here is a real finding. → A02

07 · your public code passive

Search GitHub code for your domain next to secret-looking words (github.com → search → Code):

# GitHub code search queries

"{{target}}" password
"{{target}}" api_key
"{{target}}" connectionString

Then scan your organisation's repos, including old commits:

# TruffleHog on your GitHub org (replace your-org)

$ trufflehog github --org=your-org --only-verified

needs:TruffleHoginstall ↗ - not installed? the command will fail with "command not found"

Any verified secret: rotate it today, then clean history. → A04

08 · your people passive

# emails and hosts from public sources

$ uv run theHarvester -d {{target}} -b certspotter

needs:theHarvesterinstall ↗, uv - not installed? the command will fail with "command not found"

Then check: is your email format guessable from LinkedIn? Do your job ads list exact versions of your stack?

Usernames + reused passwords = password spraying. → A07

09 · did anyone notice?

Steps 2, 3 and 6 sent real requests to your servers. Check your logs and alerts: did anything fire? If not, an attacker's recon wouldn't be noticed either. → A09

10 · shrink it

  1. Delete subdomains, apps and DNS records you don't need.
  2. Remove version headers, Swagger UI and debug pages from production.
  3. Rotate every leaked secret.
  4. Put staging behind a VPN or SSO.
  5. Repeat monthly - your attack surface grows with every deploy.