External Recon Methodology

Comprehensive guide to discovering company assets, domains, subdomains, cloud resources, emails, and credential leaks from the outside.

Overview

External reconnaissance is the process of discovering everything a company owns that is publicly accessible on the internet — before touching any target system. The goal is to build a complete picture of the attack surface.

Asset Discovery

Acquisitions

Start by finding all companies owned by the main company (subsidiaries expand scope):

• Crunchbase — search company → click “acquisitions”
• Wikipedia — search the company’s page for acquisition history
• SEC/EDGAR filings and investor relations pages (for public companies)
• OpenCorporates and the GLEIF LEI database

ASNs (IP Ranges)

An Autonomous System Number (ASN) identifies an organization’s IP ranges. Find them by company name, IP, or domain:

• bgp.he.net
• bgpview.io
• ipinfo.io
• Regional registries: AFRINIC, ARIN, APNIC, LACNIC, RIPE NCC

# Enumerate ASNs with amass
amass intel -org tesla
amass intel -asn 8911,50313,394161

# BBOT automatically summarizes ASNs at scan end
bbot -t tesla.com -f subdomain-enum

Domains

Reverse DNS

dnsrecon -r <DNS_Range> -n <IP_DNS>
dnsrecon -d facebook.com -r 157.240.221.35/24
dnsrecon -r 157.240.221.35/24 -n 1.1.1.1

Reverse Whois

Search for other assets linked to the same organization name, address, or email:

• viewdns.info/reversewhois — Free
• reversewhois.io — Free
• whoxy.com — Free web, paid API
• DomLink — Automation tool

amass intel -d tesla.com -whois

Trackers & Favicon Hashes

Find related domains by sharing the same Google Analytics ID, Adsense ID, or favicon hash:

• BuiltWith, SpyOnWeb, Publicwww

# Favicon hash search via Shodan
shodan search org:"Target" http.favicon.hash:116323821 --fields ip_str,port

import mmh3, requests, codecs

def fav_hash(url):
    response = requests.get(url)
    favicon = codecs.encode(response.content, "base64")
    fhash = mmh3.hash(favicon)
    print(f"{url} : {fhash}")
    return fhash

Certificate Transparency

Discover domains via CT logs:

• crt.sh
• certspotter.com
• search.censys.io
• chaos.projectdiscovery.io

Subdomains

OSINT Tools

# BBOT — comprehensive subdomain enumeration
bbot -t tesla.com -f subdomain-enum
bbot -t tesla.com -f subdomain-enum -rf passive  # passive only

# Amass
amass enum -d tesla.com
amass enum -active -ip -d tesla.com

# Subfinder
subfinder -d tesla.com -silent

# theHarvester
theHarvester -d tesla.com -b "anubis,bing,crtsh,dnsdumpster,google,virustotal"

# assetfinder
assetfinder --subs-only tesla.com

DNS Brute Force

# massdns — fast but may have false positives
sed 's/$/.domain.com/' subdomains.txt > bf-subdomains.txt
./massdns -r resolvers.txt -w /tmp/results.txt bf-subdomains.txt

# gobuster
gobuster dns -d mysite.com -t 50 -w subdomains.txt

# puredns
puredns bruteforce all.txt domain.com

# shuffledns
shuffledns -d example.com -list example-subdomains.txt -r resolvers.txt

Permutation Generation

Generate subdomain mutations to find more targets:

# dnsgen
cat subdomains.txt | dnsgen -

# alterx
cat subdomains.txt | alterx | dnsx -silent

# gotator
gotator -sub subdomains.txt -silent

Virtual Host Brute Force

Fuzz the Host header to find hidden vhosts:

ffuf -u http://10.10.10.10 -H "Host: FUZZ.example.com" \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -ac

gobuster vhost -u https://mysite.com -t 50 -w subdomains.txt

IPs, Web Servers, and Cloud Assets

1. Collect All IPs

   Gather IPs from discovered ranges, domains, and subdomains. Check SecurityTrails for historical IP records to find CloudFlare bypass IPs.

2. Port Scan Non-CDN IPs

   Run port scans against IPs not belonging to CDNs to find running services. Check each service against this book’s guides.

   masscan -p80,443,8000-8100,8443 199.66.11.0/24
   
3. Screenshot All Web Servers

   Take screenshots to get a quick visual overview of discovered web apps.

   Tools: EyeWitness, Gowitness, Aquatone

4. Search Cloud Assets

   Use company keywords and wordlists to find open S3 buckets, cloud functions, and storage:

   Tools: cloud_enum, CloudScraper, S3Scanner

Emails, Credential Leaks, and Secret Leaks

Email Discovery

• theHarvester
• hunter.io (free version)
• snov.io (free version)
• minelead.io (free version)

Credential Leaks

• leak-lookup.com
• dehashed.com
• Leakos + gitleaks for GitHub repos

GitHub Leaks

Search public repos of the company and its developers for exposed credentials and API keys.

# Run gitleaks on organization repos
gitleaks detect --source=./org-repos

Google Dorks

Use the Google Hacking Database or tools like Gorks to automate dork searches.

Full Recon Automation Tools

• reNgine
• Osmedeus
• reconftw

Checklist Summary

By the end of external recon you should have:

1. All companies inside the scope
2. All assets belonging to those companies (with basic vuln scans if in scope)
3. All domains belonging to the companies
4. All subdomains (check for subdomain takeovers!)
5. All IPs from CDN and non-CDN sources
6. All web servers with screenshots (anything weird?)
7. Potential public cloud assets
8. Emails, credential leaks, and secret leaks

References

• The Bug Hunter’s Methodology v4.0 - Recon Edition by @Jhaddix