Intro

Active Recon - Interacting with the target

1. Port Scanning - nmap, masscan, unicornscan
2. Vulnerability Scanning - nessus, nikto, openvas
3. Network Mapping - nmap, traceroute
4. Banner Grabbing - netcat, curl
5. OS Fingerprinting - -O
6. Service Enum - -sV
7. Web Spidering - crawling

Passive Recon - Without interacting with the target

1. Search Engine Queries - google, shodan
2. WHOIS lookup - whois cmdline
3. DNS - dig, nslookup
4. Web Archive Analysis - wayback machine
5. Social Media analysis
6. Code repos - github, gitlab