Typorithm · medium

Recon & Enumeration

recon-enumsecurityreconosintenumeration

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Recon & Enumeration

Offensive (Authorized)

Passive recon and OSINT (whois, DNS) gather information without touching the target. Active enumeration discovers subdomains and directories to map the attack surface. Defenders shrink that surface and monitor for the same probing. Run only against authorized scopes.

Recon comes in two flavors. Passive recon (OSINT) collects information from public sources — whois registration data, DNS records — without sending a single packet to the target's own infrastructure.

Active enumeration does touch the target: subfinder hunts for subdomains, gobuster probes a web server for hidden directories with a wordlist. Each discovered host or path widens the attack surface you understand.

The defensive lesson mirrors the offense: shrink the attack surface (retire stale subdomains, hide internal paths) and monitor logs for the burst of lookups and 404s these tools generate. Every command here is only ever pointed at an authorized scope.

Passive OSINT (whois, dig) does not touch the target.

Active enumeration (subfinder, gobuster) maps the surface.

Defenders shrink the surface and watch for enumeration.

whois example.com
dig +short example.com
subfinder -d example.com
gobuster dir -u https://target -w words.txt

Read the implementation

Connect each part of the code to the concept before you type.

1. Passive OSINT

whois reads public registration data without ever touching the target's servers — pure passive recon.

whois example.com

2. DNS lookup

dig resolves DNS records; +short trims the output to just the answer, mapping hostnames to addresses.

dig +short example.com

3. Subdomain discovery

subfinder enumerates subdomains of a domain, expanding the known attack surface.

subfinder -d example.com

4. Directory brute force

gobuster dir uses a wordlist to discover hidden paths on a web server — active enumeration, only against authorized hosts.

gobuster dir -u https://target -w words.txt

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.