Module 02 — Footprinting and Reconnaissance
Passive and active information gathering: Netcraft, WHOIS, DNSDumpster, Shodan, Sublist3r, Recon-ng, Sherlock and more.
Passive and Active Information Gathering
Introduction
Footprinting and Reconnaissance are the first phases of ethical hacking. The goal is to collect as much publicly available information as possible about a target before performing active enumeration or exploitation.
Note
Passive reconnaissance never touches the target directly. Active reconnaissance does — always stay inside the scope of your written authorisation.
Netcraft
Purpose — Netcraft provides detailed information about websites and domains.
It can identify:
- Hosting provider
- Web server
- Operating system
- Domain history
- Technologies used
- Website ranking
- Subdomains
Website — netcraft.com/tools
Site Report
Find infrastructure and technologies used by any website — sitereport.netcraft.com
Threat Map
Current cyber threat intelligence — netcraft.com/resources/threat-map
DNS Search
Search subdomains and DNS records — searchdns.netcraft.com
WHOIS
Purpose — Retrieve domain registration information.
Useful websites
Website uptime — who.is/uptime
DNSDumpster
Purpose — DNSDumpster discovers hosts related to a target domain.
Useful for:
- Subdomains
- DNS records
- Network mapping
- Infrastructure discovery
Website — dnsdumpster.com
Pentest-Tools
Purpose — Provides online reconnaissance and security assessment tools.
Website — pentest-tools.com
Internet Archive
Purpose — View historical versions of websites.
Useful for recovering:
- Old pages
- Images
- JavaScript
- Documents
- Source code
- Deleted content
Website — archive.org
Tip
Archived JavaScript and source files often expose old API endpoints, internal hostnames and credentials that were removed from the live site.
Shodan
Purpose — Search engine for Internet-connected devices.
Useful for:
- Servers
- Cameras
- Routers
- IoT devices
- Open ports
- Exposed services
Website — shodan.io
Google Earth & Google Maps
Purpose — Find the physical location of an organization or target.
Websites
Financial Information
Useful websites
Google Alerts
Purpose — Receive notifications whenever new content is published about a target.
Website — google.com/alerts
Social Media Footprinting
Useful platforms
- X (Twitter)
Purpose — Gather employee names, email formats, technologies, locations and organizational information.
IP Geolocation
Website — ip2location.com
Purpose — Locate public IP addresses.
Traceroute
Purpose — Display the network path to a destination.
Windows
tracert facebook.com
Linux
traceroute facebook.com
Sublist3r
Purpose — Enumerate subdomains.
Installation
sudo apt update
sudo apt install sublist3r
Example
sublist3r -d eccouncil.org -o eccouncil_info.txt
View output
cat eccouncil_info.txt
Recon-ng
Purpose — Reconnaissance framework for gathering OSINT.
Example
recon-ng
keys add github_api YOUR_GITHUB_TOKEN
workspaces create mywork
marketplace search
marketplace install recon/domains-hosts/hackertarget
modules load recon/domains-hosts/hackertarget
options set SOURCE eccouncil.org
run
exit
Warning
Never commit or share API keys added to Recon-ng — they are stored in plain text inside the workspace database.
Sherlock
Purpose — Search usernames across hundreds of websites.
Installation
sudo apt install sherlock
Example
sherlock "Elon Musk"
Save output
sherlock "Elon Musk" -o sherlock_result.txt
View output
cat sherlock_result.txt
Additional Resources
| Tool | Purpose | Link |
|---|---|---|
| NetScanTools | Network recon toolkit | netscantools.com |
| PingPlotter | Latency and route analysis | pingplotter.com |
| Email Tracker Pro | Email header tracing | emailtrackerpro.com |