Domain Reconnaissance
Enumerate subdomains, DNS records, WHOIS data, and web infrastructure in CTF OSINT challenges.
Domain Reconnaissance
Domain reconnaissance is the process of systematically gathering information about a target domain's infrastructure, ownership, and connected systems. How it works: Query WHOIS records for registrant data, use DNS lookups to find mail/name servers, check certificate transparency logs (crt.sh) for subdomains, scan for open ports, and search historical archives for past content. Why it matters: Subdomains and infrastructure details expose the attack surface; DNS TXT records frequently contain CTF flags; historical data reveals deleted content; passive techniques leave no detectable footprint.
Note: crt.sh can be unstable or return intermittent errors (HTTP 502). Alternatives for passive certificate/subdomain enumeration include Censys, SecurityTrails, and CertSpotter. Consider API usage for large queries.
Reconnaissance Steps
WHOIS and DNS basics
whois example.com # registrant info, name servers
dig example.com TXT +short # TXT records - flags often here!
dig example.com ANY # all record types
dig example.com MX # mail servers
dig @ns1.example.com example.com AXFR # zone transfer (usually blocked)dig ctf.example.com TXT +shortPassive subdomain enumeration
# Certificate transparency logs (no touching target)
curl "https://crt.sh/?q=%.example.com&output=json" | python3 -m json.tool | grep name_value
# theHarvester
theHarvester -d example.com -b all -l 500
# Subfinder
subfinder -d example.comActive subdomain brute-force
gobuster dns -d example.com -w /usr/share/wordlists/dns/subdomains-top1million-5000.txt
ffuf -w /usr/share/wordlists/subdomains-top1million-5000.txt -u http://FUZZ.example.com -fs 0
amass enum -d example.comTechnology fingerprinting
whatweb http://example.com # CMS, server, frameworks
curl -I http://example.com # HTTP headers → Server, X-Powered-ByInfrastructure scanning
nmap -sV --open example.com # open ports + service versions
shodan search "hostname:example.com" # internet-wide port dataDNS and WHOIS
dig example.com # A record (IP address)
dig example.com MX # Mail server
dig example.com NS # Name servers
dig example.com TXT # TXT records (often contain flags!)
dig example.com AAAA # IPv6
dig example.com CNAME # Canonical name alias
dig example.com SOA # Start of authority
# Short output:
dig example.com TXT +short
# Reverse DNS (PTR lookup)
dig -x 93.184.216.34
# nslookup alternative
nslookup -type=TXT example.comSubdomain and Path Enumeration
No direct contact with target:
# Certificate transparency (best passive source)
curl "https://crt.sh/?q=%.example.com&output=json" \
| python3 -c "import sys,json; [print(x['name_value']) for x in json.load(sys.stdin)]" \
| sort -u
# Shodan
shodan search "ssl.cert.subject.cn:*.example.com" --fields hostname
# theHarvester
theHarvester -d example.com -b allExposed .git Repositories
Checklist
-
whois example.com→ registrant info, name servers -
dig example.com TXT +short→ often contains flags directly -
dig example.com ANY→ all DNS records -
curl https://crt.sh/?q=%.example.com&output=json→ passive subdomains -
subfinder/gobuster dns→ active subdomain brute-force -
whatweb/curl -I→ identify tech stack -
shodan search hostname:example.com→ open ports and service banners - Wayback Machine → historical content
-
curl example.com/.git/HEAD→ exposed git source -
gobuster dir→ hidden files and directories
Last updated on