Reconnaissance is the first phase of a cyber attack, where an attacker gathers information about the target system or network. This phase is crucial for identifying vulnerabilities and planning the attack. Below are some popular reconnaissance tools used in Linux:
1. Nmap (Network Mapper)
Description:
Nmap is a powerful network scanning tool used to discover hosts and services on a computer network by sending packets and analyzing the responses.
Use Case:
- Port scanning
- Service version detection
- OS fingerprinting
Installation:
sudo apt-get install nmapExample Command:
Scan a target IP for open ports and services:
nmap -sV 192.168.1.1Useful Links:
2. Recon-ng
Description:
Recon-ng is a full-featured web reconnaissance framework written in Python. It is designed for open-source intelligence (OSINT) gathering.
Use Case:
- Domain enumeration
- Subdomain discovery
- Data harvesting
Installation:
sudo apt-get install recon-ngExample Command:
Start Recon-ng and use a module for domain enumeration:
recon-ng
marketplace install recon/domains-hosts/brute_hosts
modules load recon/domains-hosts/brute_hosts
options set SOURCE example.com
runUseful Links:
3. theHarvester
Description:
theHarvester is a tool for gathering emails, subdomains, hosts, employee names, open ports, and banners from different public sources.
Use Case:
- Email harvesting
- Subdomain enumeration
- OSINT gathering
Installation:
sudo apt-get install theharvesterExample Command:
Search for emails and subdomains associated with a domain:
theHarvester -d example.com -b googleUseful Links:
4. Shodan
Description:
Shodan is a search engine for internet-connected devices. It allows you to find devices, servers, and services exposed on the internet.
Use Case:
- Finding vulnerable devices
- Identifying open ports and services
- Network reconnaissance
Installation:
Shodan can be accessed via its web interface or CLI tool. Install the CLI tool:
pip install shodanExample Command:
Search for devices running Apache:
shodan search 'apache'Useful Links:
5. Maltego
Description:
Maltego is a graphical tool for link analysis and data mining. It is widely used for OSINT and reconnaissance.
Use Case:
- Visualizing relationships between entities
- Gathering information about domains, IPs, and people
Installation:
Download Maltego from the official website and install it:
wget https://maltego-downloads.s3.us-east-2.amazonaws.com/linux/Maltego.v4.3.0.deb
sudo dpkg -i Maltego.v4.3.0.debUseful Links:
6. Sublist3r
Description:
Sublist3r is a Python tool designed to enumerate subdomains of websites using search engines and other sources.
Use Case:
- Subdomain enumeration
- Reconnaissance for penetration testing
Installation:
git clone https://github.com/aboul3la/Sublist3r.git
cd Sublist3r
pip install -r requirements.txtExample Command:
Enumerate subdomains of a domain:
python sublist3r.py -d example.comUseful Links:
7. Amass
Description:
Amass is a tool for in-depth DNS enumeration and network mapping. It can discover assets, subdomains, and other information.
Use Case:
- DNS enumeration
- Network mapping
Installation:
sudo apt-get install amassExample Command:
Perform DNS enumeration on a domain:
amass enum -d example.comUseful Links:
8. Nikto
Description:
Nikto is a web server scanner that tests for dangerous files, outdated server software, and other vulnerabilities.
Use Case:
- Web server vulnerability scanning
- Identifying misconfigurations
Installation:
sudo apt-get install niktoExample Command:
Scan a web server for vulnerabilities:
nikto -h http://example.comUseful Links:
9. DNSenum
Description:
DNSenum is a tool for DNS enumeration. It gathers information about DNS records, subdomains, and more.
Use Case:
- DNS reconnaissance
- Subdomain enumeration
Installation:
sudo apt-get install dnsenumExample Command:
Enumerate DNS information for a domain:
dnsenum example.comUseful Links:
10. Wfuzz
Description:
Wfuzz is a web application brute-forcing tool. It can be used to discover hidden resources, directories, and parameters.
Use Case:
- Directory brute-forcing
- Parameter fuzzing
Installation:
sudo apt-get install wfuzzExample Command:
Brute-force directories on a web server:
wfuzz -c -z file,wordlist.txt --hc 404 http://example.com/FUZZUseful Links:
Conclusion
Reconnaissance tools are essential for both attackers and defenders. While attackers use them to gather information, defenders can use the same tools to identify and mitigate vulnerabilities. Always ensure you have proper authorization before using these tools on any network or system.
