Website Recon & Footprinting: An Attacker-Perspective Methodology
Disclaimer
This documentation is written for learning purposes only. Any tools, techniques, or examples shown here are for educational reference. Never run any of these tools or techniques against any address, machine, or network without explicit, proper authorization.
Intro
Reconnaissance is the first phase of any assessment: before an attacker (or a pentester) touches a target, they build a map of it using only public, passive sources. This document walks through that methodology tool by tool, framed around what an attacker is actually trying to learn at each step and since this site is about cybersecurity: what a defender should check to see if they're already exposed.
Goals of this phase:
- IP addresses
- Directories hidden from search engines
- Names
- Email addresses
- Phone numbers
- Physical addresses
- Web technologies being used
DNS & Host Resolution
DNS records are public by design, but they routinely leak more than intended: mail server hostnames, internal naming conventions, forgotten subdomains, or third-party services in use (which themselves become new attack surface).
Method
host : quick DNS lookups for A/MX records:
host domain.com
# domain.com has address 128.111.111.11
# domain.com mail is handled by 10 mail.domain.com.
DNSRecon: a Python tool that automates a full DNS sweep:
- Checks all NS records for zone transfer misconfigurations
- Enumerates general DNS records (MX, SOA, NS, A, AAAA, SPF, TXT)
- Performs SRV record enumeration
- Expands top-level domains (TLD)
- Checks for wildcard resolution
- Brute-forces subdomains against a wordlist
- Performs PTR lookups for an IP range/CIDR
- Enumerates hosts and subdomains via Google
Defensive Takeaway
Run dnsrecon -d yourdomain.com against your own domain periodically. If it succeeds in a zone transfer, that's a critical misconfiguration — DNS zone transfers should be restricted to authorized secondary servers only.
WHOIS Enumeration
WHOIS records tie a domain to a registrant historically full name, email, phone, and physical address, though most registrars now offer (and modern regulation increasingly requires) privacy redaction. Where redaction isn't enabled, this is a direct pivot from "domain name" to "real person."
Method
Related tools:
- ZoneTransfer.me: A deliberately vulnerable domain for practicing zone transfer attacks
- Netcraft: A site reports including hosting history and technology stack
Confirm WHOIS privacy/redaction is enabled on every domain you own. If you manage domains for others, this is a five-minute check worth adding to any hardening checklist.
Website & Technology Footprinting
Knowing the exact CMS, framework, and plugin versions a site runs lets an attacker go straight to known CVEs for that stack instead of guessing. robots.txt is a special case: it's meant to tell search engines what not to index, which often means it's an unintentional map of the directories an owner most wants hidden.
Method
domain.com/robots.txt: often reveals admin panels, staging paths, or internal tooling- BuiltWith / Wappalyzer (browser extensions): passively fingerprint the tech stack of any page you visit
- WhatWeb (Kali):
- HTTrack Website Copier: mirrors a full site for offline analysis
- Netcraft: cybersecurity company providing cybercrime disruption and digital risk protection, useful here for its hosting/history reports
Never rely on robots.txt to hide something sensitive, it's a request to crawlers, not an security control. Anything that must stay private needs actual authentication, not a polite ask.
WAF Detection
Knowing whether a target sits behind a Web Application Firewall and which one changes an attacker's approach: payloads get crafted to evade known WAF signatures rather than sent blind.
Method
wafw00f fingerprints WAFs in three escalating steps:
- Sends a normal HTTP request and analyzes the response, this alone identifies a number of WAF solutions
- If unsuccessful, sends a series of potentially malicious requests and uses logic to deduce the WAF from behavior
- If still unsuccessful, analyzes the accumulated responses and estimates whether any WAF or security solution is actively responding
If wafw00f can't confidently identify your WAF, that's a small win some WAF vendors specifically tune responses to resist fingerprinting. Worth checking your own perimeter with it.
Subdomain Enumeration
Subdomains are frequently where the weakest link lives a forgotten staging environment, an old marketing microsite, an internal tool exposed by accident. Attackers enumerate them because the main domain is rarely the softest target.
Method
Sublist3r aggregates subdomains from multiple OSINT sources at once: Google, Yahoo, Bing, Baidu, Ask, Netcraft, VirusTotal, ThreatCrowd, DNSDumpster, and reverse DNS:
Run this against your own domain and audit every result. Decommissioned subdomains should be removed from DNS entirely, not just left unlinked "unlinked" is not "unreachable."
Google Dorking
Google Dorking uses advanced search operators to surface content that was never meant to be public but got indexed anyway exposed credential files, admin login pages, misconfigured directory listings.
Method
- Operators like
site:,filetype:, andintitle:refine searches to specific exposure types - Common patterns: enumerating subdomains, hunting exposed credential files
Reference: Google Hacking Database
theHarvester rounds out this phase by aggregating names, emails, IPs, subdomains, and URLs from multiple public sources in one pass useful for building an org's external threat landscape quickly:
Periodically dork your own domain (site:yourdomain.com filetype:txt, site:yourdomain.com inurl:admin, etc.) this is exactly what an attacker does before touching your infrastructure, and it costs nothing to check first.
Leaked Credentials
Recon isn't limited to the target's infrastructure, an attacker will also check whether any employee credentials have already surfaced in a prior breach, since reused passwords are still one of the most common initial access vectors.
Method
- Have I Been Pwned: checks an email address or domain against known breach corpora
Register your organization's domain with HIBP's domain monitoring where available, and enforce MFA everywhere so a leaked password alone isn't enough for account takeover.