The newest Recon resources are on the Recon page. For a reading order instead of a date order, see the Recon learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2021-11-01 2021 | dhondta/webgrep beginner 3 min read | Tool for grepping web pages and associated resources, enhancing the functionality of the standard `grep` command. It supports deobfuscating JavaScript, applying OCR to images, and extracting EXIF data using external tools like `tesseract` and `exiftool`. The tool allows for searching across local or all linked resources, including HTTP headers, and offers extensive options for regular expression matching and output control. |
| 2021-10-28 2021 | Haklukes Guide to AmassHow to Use Amass More Effectively for Bug Bounties intermediate Bug Bounty | Haklukes Guide to AmassHow to Use Amass More Effectively for Bug Bounties |
| 2021-10-28 2021 | OWASP Amass - Users' Guide beginner 4 min read | Library for internet exposure investigation; this guide details OWASP Amass tool usage for subdomain enumeration via DNS and network mapping. It covers basic commands like `amass enum -d example.com` and advanced options including active enumeration (TLS certificates, zone transfers, web crawling) with `amass enum -active -d example.com`, passive data source utilization with `amass enum --passive -d example.com`, and Docker integration. The guide also explains configuration file management, API key storage, graph database persistence (file-based or PostgreSQL), and how findings from previous enumerations are leveraged. |
| 2021-10-28 2021 | Amass/config.ini at master OWASP/Amass beginner | Amass/config.ini at master OWASP/Amass |
| 2021-10-28 2021 | OWASP Amass - An Extensive Tutorial intermediate 10 min read | Library for passive and active reconnaissance, Amass facilitates subdomain discovery and external attack surface mapping using over 80 data sources. Its three subcommands, `intel`, `enum`, and `db`, support techniques like brute-forcing, DNS zone transfers, and certificate transparency log analysis, with findings stored in a graph database. |
| 2021-10-28 2021 | OWASP/Amass beginner 2 min read | Library for network asset discovery and attack surface mapping. This entry details installation instructions for Amass across various platforms including macOS (resolving "unidentified developer" warnings), Docker, Go compilation, Homebrew, FreeBSD, Kali Linux, NixOS, Gentoo, and Pentoo. It covers building Docker images, persisting graph databases, utilizing wordlists, and compiling from source with Go 1.18+. |
| 2021-10-28 2021 | How to Use OWASP Amass: An Extensive Tutorial intermediate 14 min read | Library for continuous subdomain discovery and external attack surface mapping, OWASP Amass offers multiple subcommands: `intel` for open-source intelligence gathering, `enum` for DNS enumeration and network mapping, `viz` for visualizing results, `track` for monitoring changes, and `db` for manipulating the graph database. It supports numerous data sources and techniques, including WHOIS, certificate transparency logs, DNS zone transfers, and brute-forcing, making it a comprehensive tool for penetration testers and security researchers. |
| 2021-09-29 2021 | Subnet Calculator beginner | Tool for calculating subnet information. Enter a subnet range in CIDR notation or use the optional mask pull-down to view IP address details. This is particularly useful for network operators and service providers who frequently work with subnet allocations, providing an easy way to understand Classless Inter-Domain Routing (CIDR) blocks. |
| 2021-09-17 2021 | Cloud Security Orienteering beginner 22 min read | Library for navigating unfamiliar AWS environments, this resource details a methodology for identifying risks, prioritizing remediation, and defining long-term cloud security strategies. It covers challenges in cloud security best practices, common adoption patterns, identifying ecosystem scope, and prioritizing important risks with open-source tools. The guide references the CIS benchmark for configuration, the Well-Architected Framework Security Pillar for architecture, and Scott Piper’s AWS Security Maturity Roadmap. → tldrsec.com |
| 2021-09-15 2021 | My Favorite Pentest Tools (Top 15) beginner Bug Bounty | My Favorite Pentest Tools (Top 15) |
| 2021-09-13 2021 | Haklukes Guide to NmapPort Scanning is Just The Beginning beginner | Haklukes Guide to NmapPort Scanning is Just The Beginning |
| 2021-09-07 2021 | Dan Miessler Talks About Recon/Automation Seclists Certifications Mental Health & More! beginner Talks | Dan Miessler Talks About Recon/Automation Seclists Certifications Mental Health & More! |
| 2021-08-30 2021 | api_wordlist beginner 1 min read API Sec | Library of API names for web application security testing. It includes files like `api_seen_in_wild.txt`, `actions.txt`, and `objects.txt`, along with variations for case sensitivity. The library provides guidance for using these lists with Burp Suite's Intruder in a Cluster Bomb attack to fuzz API function calls by sending requests and replacing function names with runtime files. |
| 2021-08-30 2021 | Hakluke's huge list of resources for beginner hackers beginner 6 min read Bug Bounty | Library containing a curated list of resources for beginner hackers, focusing on bug bounty hunting and penetration testing. It aggregates links to various "list of lists" from prominent figures like Nahamsec and Codingo, alongside hands-on labs from Pentesterlab, Portswigger, Tryhackme, Hackthebox, Kontra, Hacker101, and Vulnhub. The library also highlights essential YouTube channels such as John Hammond, Liveoverflow, and PwnFunction, and a comprehensive list of cybersecurity Twitter accounts and blogs like Hackerone Hacktivity and Intigriti's Medium publication. → labs.detectify.com |
| 2021-08-30 2021 | Introducing dirtywords - A Targeted Word List Generator intermediate | Tool for generating targeted word lists for password cracking and authentication testing. Dirtywords utilizes OSINT data such as names, dates, locations, and organizational terms to create custom lists optimized for identifying common, specific password patterns often missed by generic lists. It generates permutations by applying common construction techniques like CamelCase, leetspeak, appended numbers and special characters, and date formats. The source code is available on GitHub. |
| 2021-08-25 2021 | Recon as a Platform (RaaP)? beginner | Library for building reconnaissance platforms, RaaP addresses scenarios where existing tools are unknown, lack desired performance or features (e.g., specific subdomain scraping), or fail to enrich results through integration. It helps overcome limitations in system design scalability, aids in recalling past reconnaissance flows, and facilitates benchmarking of multiple projects for problems like subdomain takeovers. RaaP also serves as a reference for adding features to existing reconnaissance projects or for manual reconnaissance efforts, and helps avoid redundant research when building custom reconnaissance solutions. |
| 2021-08-25 2021 | RaaP beginner | RaaP |
| 2021-06-30 2021 | Web-Application-Pentest-Checklist intermediate API Sec Bug Bounty | This content is a checklist for web application penetration testing. It outlines a comprehensive set of steps and areas to cover when assessing the security of web applications. The checklist likely includes categories such as reconnaissance, authentication, authorization, input validation, session management, and common vulnerabilities like SQL injection and cross-site scripting (XSS). It serves as a guide for penetration testers to ensure thorough and systematic testing. |
| 2021-05-31 2021 | Offensive Security Guide to SSH Tunnels and Proxies intermediate | This guide from Offensive Security explores the practical applications of SSH tunnels and proxies for penetration testers. It details how to leverage these techniques to bypass network restrictions, access internal systems, and exfiltrate data securely. The content covers different tunneling methods, including local, remote, and dynamic port forwarding, and provides real-world examples for reconnaissance, lateral movement, and command and control. The primary focus is on using SSH to establish covert communication channels and gain deeper access within target environments. |
| 2021-05-17 2021 | How to discover up to 10000 subdomains with your own tool beginner | |
| 2021-05-11 2021 | VPS-web-hacking-tools beginner Bug Bounty | Library for automatically installing web hacking and bug bounty tools on Debian, Kali Linux, Linux Mint, and Ubuntu VPS systems. It supports both direct installation via an installer script and a Dockerized version for simplified deployment. Tools like Corsy and CORScanner are included, with users advised to configure them for optimal use, particularly for subdomain enumeration. |
| 2021-05-05 2021 | How to discover up to 10000 subdomains with your own tool intermediate Bug Bounty | This article details a method for discovering up to 10,000 subdomains using a self-created tool. It likely covers the technical steps and strategies involved in building and deploying such a tool for subdomain enumeration, a common practice in cybersecurity for identifying potential attack surfaces. The content focuses on practical application and achieving a significant scale of subdomain discovery. |
| 2021-05-04 2021 | Web App #Penetration Testing for Beginners: beginner Bug Bounty | This content is a beginner's guide to web application penetration testing. It aims to introduce fundamental concepts and techniques for identifying vulnerabilities in web applications. The focus is on providing a foundational understanding for those new to the field of cybersecurity and penetration testing. |
| 2020-03-08 2020 | GitHub - redhuntlabs/Awesome-Asset-Discovery: List of Awesome Asset Discovery Resources beginner 5 min read | Library of curated resources for asset discovery in security assessments, categorizing tools and techniques for content, IP, domain, email, network, cloud, and source code discovery. It lists specific utilities like `rustbuster`, `Mxtoolbox`, `Massdns`, `DataSploit`, `SubFinder`, `Amass`, `GoBuster`, `Hunter`, `Zmap`, `Masscan`, `Nmap`, `MicroBurst`, `Gitrob`, `CloudScraper`, `Buckets Grayhatwarfare`, `Shodan`, and `Censys`, alongside methods for identifying data leaks and social media profiling. |