Web Recon Methodology: How I Map an Attack Surface

Fri, 20 Jun 2025 00:00:00 +0000

Reconnaissance is where engagements are won or lost. The best exploit in the world is useless if you aimed it at the wrong target. This post breaks down my web recon process — what I run, in what order, and what I’m actually looking for.

Philosophy First Link to heading

Recon is not about running every tool you have. It’s about building an accurate mental model of the target:

recon-toolkit

Sat, 01 Mar 2025 00:00:00 +0000

A modular recon automation framework that chains together passive and active discovery techniques — subdomain brute-forcing, DNS resolution, HTTP probing, port scanning, and screenshot capture — into a single pipeline.

Features:

Passive subdomain discovery via crt.sh, Shodan, and VirusTotal APIs
Active DNS brute-force with custom wordlists
HTTP service detection and technology fingerprinting
Automated screenshot capture of live hosts
Output to structured JSON and HTML reports

Tech: Python, asyncio, aiohttp, dnspython, Shodan API

Bug-Bounty on Njeru Mtwaiti

Web Recon Methodology: How I Map an Attack Surface

Philosophy First Link to heading

recon-toolkit