LUDA HEX

Type to search the docs and blog.

Web Reconnaissance Documentation

This documentation will show you what I look out for when I do any kind of web reconnaissance. It could be for websites themselves, connected devices with hosted or remote administration panels, any kind of content and when looking at IP communications. I break down a bit of why each piece of information could be important, then we attempt to automate some of it.

This documentation will:

  • take you through my reconnaissance methodology process
  • set up a research and development environment
  • use our programming skills to write our own programs
  • test what can be automated, and continue to verify it’s working
  • do some very basic data analytics
  • help you report on what you’ve found

Head over to a specific topic:

Domain Names and URLs

  • some of these concepts might be new to you, some of them you may already know, I break down what a domain name and URL are but I might skip over certain details. We build on topics such as ports

I was the kind of kid who loved to find out every little detail about something specific, and then optimise it, but maybe not in the way you’d expect. I like to speedrun my video games. You’re just about to beat world 8, level 8, you jump, you miss, the floor is lava. That brutality of having to restart the entire playthrough just to try again without losing a life, was what kept me interested, I had to make my own game within a game.

It wasn’t enough to just restart 1 level, I wanted to be able to finish end to end without dying. My favourite speedrun self-set challenge was to get as many lives, as quickly as possible, and beat Super Mario Bros 3 on the Game Boy Color. That was before I discovered Lost Levels and that just continues to scratch that itch.

There are a couple of key points here:

  • I did things manually, to find out how things worked
  • I did them until I felt comfortable I could recall it, understand what and why something is happening

The next thing was to automate it, keep it tested, and see what information I lost when I did automate it. That told me any steps that needed to be kept manual (for now) - and if there was any other way I could get my hands on that information.

These docs are a work in progress, so I’ll be adding as I get through everything I have. It’s a nice way to organise my thinking :) Enjoy!