Top Recon & OSINT Tools

Reconnaissance (recon) is the first and most important step in ethical hacking. It means collecting as much information as possible about a target before trying to attack. The better your recon, the better your chances of finding real issues.

In this blog, I’ll break down some of the most common tools and methods in simple words.

Domain & Ownership Discovery

• WHOIS → Finds the owner of a domain or IP.
• Reverse WHOIS (ViewDNS.info) → Lets you search domains by a keyword (e.g., company name).
• nslookup → Queries name servers to get IP info.
• Reverse IP (ViewDNS.info) → Finds other domains hosted on the same IP.
• crt.sh / Censys / Cert Spotter → Show SSL certificates linked to a domain.

Subdomain Discovery

• Sublist3r, SubBrute, Amass, Gobuster → Tools to find subdomains.
• SecLists & Commonspeak2 → Wordlists used for brute-forcing subdomains and paths.
• Altdns → Generates permutations of subdomains to discover more.

Port Scanning & Service Discovery

• Nmap & Masscan → Scan a server for open ports and running services.
• Shodan, Censys, Project Sonar → Search engines that reveal services on targets without scanning yourself.

Directory & File Discovery

• Dirsearch & Gobuster → Brute-force hidden file paths and directories.

Content & Screenshot Tools

• EyeWitness & Snapper → Take screenshots of multiple URLs to quickly spot interesting pages.
• OWASP ZAP → Security tool with a spider to discover content automatically.

Cloud & Storage Buckets

• GrayhatWarfare → Search engine for open Amazon S3 buckets.
• Lazys3 & Bucket Stream → Brute-force bucket names to find misconfigured storage.

OSINT (Open Source Intelligence)

• Google Hacking Database → Pre-made Google search terms for finding sensitive info.
• KeyHacks → Helps validate credentials and use them.
• Gitrob & TruffleHog → Look for secrets in GitHub repos.
• PasteHunter → Finds sensitive info in paste sites.
• Wayback Machine & Waybackurls → Show old versions of sites and their files.

Tech Stack Fingerprinting

• CVE database → Look up known vulnerabilities.
• Wappalyzer / BuiltWith / StackShare → Show technologies a website uses.
• Retire.js → Detects outdated JavaScript libraries.

Automation

• Git → Use git diff to track changes.
• Nuclei & Intrigue Core → Automate recon workflows.

Wrapping Up

Recon is like detective work, it’s about collecting pieces of information and connecting the dots. Start small, learn each tool manually, and then build automation as you grow. Over time, you’ll create your own recon workflow that makes hacking faster, easier, and more effective.