Reconnaissance

Complete Security Testing Methodology Hub The full security testing lifecycle, from reconnaissance through fuzzing to reporting. 🔍 Reconnaissance & Intelligence Gathering Open Source Intelligence (OSINT) Comprehensive OSINT Guide AI-assisted intelligence gathering, blockchain analysis Enhanced social media techniques, modern automation TikTok intelligence, emerging platform analysis Reconnaissance Guide Cloud-native techniques, container/serverless discovery Modern API reconnaissance, automated attack surface mapping ML-powered automation, continuous monitoring Advanced Intelligence Collection Attack surface discovery with modern cloud infrastructure Subdomain enumeration with 2026 techniques Content discovery and hidden endpoint identification JavaScript mining and client-side analysis Cloud asset hunting across AWS/GCP/Azure 🧪 Security Testing Tools & Techniques Professional Testing Tools Comprehensive Burp Suite Guide Enterprise DAST features, modern extensions (BurpAPISecuritySuite) Advanced BChecks/Bambdas, CI/CD integration Burp AI capabilities, professional workflows Automated Testing & Fuzzing Fuzzing Guide - AI-augmented techniques JVM fuzzing via Jazzer, Kotlin coroutine testing Advanced coverage methods, modern language support Web, binary, kernel, API, and smart-contract targets Mobile Application Testing Mobile Security Guide 2026 mobile threat intelligence, LANDFALL spyware analysis WebKit CVEs, iOS/Android security assessment Modern testing methodology, defensive controls 🎯 Specialized Testing Methodologies Bug Bounty & Vulnerability Research Bug Bounty Hunting Guide - AI-augmented methodology 2026 platform analysis, advanced reconnaissance pipelines Emerging vulnerability classes (SAML, WebAuthn, WASM) Automated chaining, data-driven career strategy Modern Security Challenges AI/LLM Security Testing AI system attack surface, prompt injection testing Jailbreak techniques, agentic system exploitation Layered detection and prevention strategies Supply Chain & Infrastructure Supply Chain Security CI/CD security testing, dependency scanning Package registry attack testing, SBOM validation Artifact provenance verification 🎓 Security Testing Learning Paths Beginner → Professional → Advanced Foundation Path: OSINT → Reconnaissance → Bug Bounty ...

Comprehensive Recon Guide 🆕 Updated September 12, 2026 — added open directories as a recon corpus, via Hunt.io’s breakdown of a live operator toolkit targeting Ukrainian infrastructure. A practitioner’s reference for web reconnaissance — attack surface discovery, subdomain enumeration, live host probing, content discovery, JS mining, cloud asset hunting, automation, and continuous monitoring. Enhanced for 2026 with modern cloud infrastructure discovery, ML-powered automation, and API reconnaissance techniques. Table of Contents Fundamentals Scope & Target Profiling Subdomain Enumeration DNS Brute Force & Permutation Live Host Discovery & HTTP Probing Port Scanning URL & Endpoint Crawling JavaScript Analysis Content & Directory Discovery Parameter Discovery Technology Fingerprinting Cloud Asset Discovery GitHub & Code Leak Hunting ASN & Infrastructure Expansion Container & Serverless Discovery Modern API Reconnaissance ML-Powered Automation Wordlist Resources Automation Pipelines Continuous Monitoring Real-World Recon Wins Quick Reference 1. Fundamentals Recon is 80% of offensive security. The researchers who earn six figures aren’t running more tools than everyone else — they’re running them in smarter pipelines, feeding the output of one into the next, and manually reviewing the long tail that automation misses. Every hour spent deepening the asset inventory pays off when hunting begins: more subdomains means more parameters, more endpoints, more code paths, more chances for a bug nobody else has seen. ...

Comprehensive OSINT Guide 🆕 Updated September 12, 2026 — added phishing-infrastructure pivoting from the 0ktapus case study: DOM template hashes, replicated victim assets, and why kit clusters aren’t actor clusters. A practitioner’s reference for Open Source Intelligence — methodology, collection disciplines, tooling, pivoting techniques, and operational security. Includes 2026 AI-assisted techniques and emerging platform intelligence. Table of Contents Fundamentals The OSINT Lifecycle People OSINT (HUMINT/SOCMINT) Company & Corporate OSINT Infrastructure & Network OSINT Domain, DNS & Certificate Intel Social Media Intelligence 2026 Enhanced Social Media Intelligence Geolocation & Imagery (GEOINT) Breach, Leak & Paste Intel Metadata Extraction Code & Repository OSINT Dark Web & Threat Intel IoT & Device Discovery Tools Reference Automation & Visualization Cloud & Modern Infrastructure Intelligence Blockchain & Financial Intelligence 2026 AI-Assisted OSINT 2026 Anti-Detection & Privacy Evasion Continuous Monitoring & Threat Hunting Operational Security Legal & Ethical Considerations Quick Reference 1. Fundamentals Open Source Intelligence (OSINT) is the discipline of collecting, correlating, and analyzing information that is publicly or legally available to produce actionable intelligence. “Open source” does not mean “easy” or “low value” — it means no clandestine collection is involved. The sources are lawful: the skill lies in knowing where to look, how to pivot, and how to assemble fragments into a coherent picture. ...