Reconnaissance: OSINT Gathering, Shodan & Advanced Google Dorking

Reconnaissance is the initial, foundational phase of the Cyber Kill Chain and ethical penetration testing. Over 80% of a penetration tester's time is invested in gathering intelligence about target networks, exposed servers, employee emails, leaked credentials, and third-party SaaS tools. Reconnaissance is divided into Passive Recon (OSINT) and Active Recon.

Passive Recon (OSINT) vs. Active Reconnaissance

Passive Reconnaissance (OSINT): Gathering publicly available intelligence without ever sending a single network packet to the target organization's servers. The target has zero logs of your activity (e.g. querying WHOIS, public certificate transparency logs, Shodan, LinkedIn).
Active Reconnaissance: Directly probing target servers (e.g. port scanning with Nmap, directory fuzzing with Gobuster). Active recon generates logs in target firewalls and IDS/IPS sensors.

Google Dorking: Advanced Search Engine Operators

Search engines continuously index the public internet. Hackers use specialized Google search operators ("Google Dorks") to locate accidentally exposed configuration files, database backups, and unauthenticated administrative portals:

Google Dork Query	Intelligence Target Uncovered
`filetype:env "DB_PASSWORD"`	Finds accidentally committed `.env` files containing cleartext database credentials and API keys.
`filetype:sql "INSERT INTO" "password"`	Locates public database dump files left on open web directories.
`inurl:admin "login" site:example.com`	Identifies hidden administrative login portals on the target domain.
`intitle:"index of /" "backup.zip"`	Discovers open Apache/Nginx directory listings hosting compressed site backups.
`filetype:pdf "confidential" site:example.com`	Unearths internal corporate reports, contracts, and confidential strategic memos.

Shodan: The Search Engine for Internet-Connected Devices

Unlike Google which indexes HTML web page content, Shodan continuously crawls the internet grabbing service banner responses from public IP addresses across all ports (industrial control systems, IoT webcams, database servers, and routers):

Powerful Shodan Search Filters

# 1. Locate exposed MongoDB databases with authentication disabled
product:"MongoDB" -authentication

# 2. Find exposed remote desktop (RDP) servers in a specific country
port:3389 country:"IN"

# 3. Find unpatched Apache servers running in a specific subnet
net:198.51.100.0/24 product:"Apache"

# 4. Search for default camera streaming portals
"Server: webcam" title:"Live View"

Automated Subdomain Enumeration

Attackers uncover forgotten development servers (e.g. dev.example.com, staging-api.example.com) using automated subdomain tools that query Certificate Transparency (CT) logs:

# Query public Certificate Transparency logs via crt.sh
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

# Subdomain enumeration using subfinder
subfinder -d example.com -o subdomains.txt

Frequently Asked Questions (FAQ) - Student & Interview Review

Q1. What is Certificate Transparency (CT) logging?

A public, append-only cryptographic ledger of all SSL/TLS certificates issued by Certificate Authorities. Because CAs must publicly log certificates to be trusted by Chrome, security researchers search CT logs (via crt.sh) to discover all subdomains of a company.

Q2. What is theHarvester?

theHarvester is an open-source OSINT tool that gathers employee email addresses, names, subdomains, open ports, and employee PGP key fingerprints from LinkedIn, Google, Bing, and Twitter.