Recon & OSINT
Penetration Testing
- Chapters
- 13
- Reading time
- 42.3 h
- Level
- Beginner → Intermediate → Advanced
13 chapters
Start reading →- Reconnaissance: Passive vs Active & the Attack SurfaceBeginner · 170 min
- Passive Recon: WHOIS, DNS Enumeration & Certificate TransparencyBeginner · 180 min
- OSINT Foundations: Discipline, OPSEC & Sock-Puppet AccountsBeginner · 180 min
- Google Dorking & Search-Engine Recon for HackersIntermediate · 175 min
- Subdomain Enumeration: Amass, Subfinder, Sublist3r & AssetfinderIntermediate · 185 min
- OSINT Frameworks: theHarvester, Recon-ng, SpiderFoot & MaltegoIntermediate · 190 min
- Username, Email & Account OSINT: Sherlock, Maigret & HoleheIntermediate · 195 min
- Breach Data, Credential Leaks & Dark-Web OSINTIntermediate · 200 min
- Shodan, Censys & Internet-Wide Asset DiscoveryAdvanced · 205 min
- Active Recon & Tech Fingerprinting: httpx, whatweb & WappalyzerAdvanced · 210 min
- Image, Geolocation & Metadata OSINT: ExifTool, Reverse Image & GEOINTAdvanced · 215 min
- Corporate, People & Social-Media OSINT for Red TeamsAdvanced · 215 min
- Automating Recon: Building an End-to-End OSINT & Attack-Surface PipelineAdvanced · 215 min