[Shutzhacker]

best and effective way of doing a Web Application recon. Is it just by looking up on google with some dorks or shodan or scanning for some subdomains and also ips related to the target domain or is it beyond that.

I will love to hear your thoughts and how you engage doing your recon also do you enjoy the process or it’s boring 🥱

[s0lo]

dont know if its the best or close to that, but i enjoy using rengine for doing recon on web

[Shutzhacker]

dont know if its the best or close to that, but i enjoy using rengine for doing recon on web

It works for you ?

[s0lo]

It works for you ?

love it, look it up, it just combines multiple tools, APIs, LLMs, automates the process and then you just dig through and act on the findings

[Shutzhacker]

Start with passive techniques, such as domain and subdomain discovery (using tools like WHOIS, Sublist3r, or Amass), Google dorking, and OSINT analysis via social media and search engines. Next, conduct active reconnaissance with tools like Nmap to scan ports, Burp Suite to analyze HTTP headers, and Nikto for vulnerability scanning. Advanced techniques include brute-forcing login forms, fuzzing for input validation flaws, and testing for common vulnerabilities like SQL injection and XSS.

Nice thanks for sharing your thoughts with everyone