Red Team Recon Techniques - Red Team Series

This course demonstrates passive and active reconnaissance for red team operations. It covers DNS and subdomain enumeration, employee-information gathering, port and vulnerability scanning, directory brute forcing, and automation with tools including Amass, Sniper, and recon-ng.

Syllabus

Introduction
What is Reconnaissance?
Mitre Attack Recon Techniques Overview
Let’s Begin with Passive Reconnaissance
Using the host command
Using the nslookup command
Using the traceroute command
Using the dnsrecon command Passively
Using the wafw00f command
Using the dig command
Using the WHOIS Utility
Using Netcraft
Using DNS Dumpster
Using whatweb
Using Browser Addons
Gathering Employee Information
Using the Harvester
Subdomain Enumeration
Active Intelligence Gathering
Using dnsrecon Actively
Brute Forcing Subdomains with Fierce
Using knockpy
Using Port Scanning
Vulnerability Scanning
Directory Brute Forcing
Automating these Tests
Scanning with Sniper Active
Scanning with Sniper Passively
Using Amass - Basic Scan
Using Amass - Advanced Scan
Using the viz Subcommand
Viewing Reports
Performing Passive Recon with recon-ng
Conclusion