External Recon Methodology

Start with legal entities, known brands, root domains, approved subsidiaries, and documented network ranges. Treat acquisitions, partner systems, managed services, and shared hosting as uncertain until ownership is confirmed.

dig +short NS example.com
dig +short MX example.com
dig +short TXT example.com
dig +short CAA example.com

1. 01

   Collect names from authoritative inventory and approved passive sources.

2. 02

   Normalize case, remove wildcards, and de-duplicate.

3. 03

   Resolve A, AAAA, CNAME, MX, NS, TXT, and CAA records.

4. 04

   Identify wildcard DNS and parked records.

5. 05

   Validate ownership before any active request.

openssl s_client -connect example.com:443 \
  -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Map organization-owned ranges separately from CDN, shared hosting, and cloud-provider space. Cloud naming conventions can support hypotheses, but do not prove ownership.

• Whois/RDAP ownership matches the approved entity.
• Reverse DNS and certificate evidence agree.
• Cloud account or subscription owner confirms the resource.
• CDN origin discovery remains prohibited unless explicitly included.
• Storage permission checks are read-only and use synthetic data only.

Validate only confirmed in-scope hosts. Begin with expected web ports and a narrow service set before expanding under the agreed rules.

nmap -sV -T2 --max-rate 20 \
  -p 22,80,443,8080,8443 192.0.2.10 \
  -oA approved-service-check

• Capture HTTP status, title, redirect, TLS name, and technology confidence.
• Group duplicate frontends by certificate, favicon, redirect, and body signature.
• Take screenshots only after login and privacy implications are agreed.
• Do not bypass a CDN or WAF unless origin testing is explicitly in scope.

1. 01

   Create one canonical record per asset.

2. 02

   Score ownership confidence and exposure.

3. 03

   Prioritize admin surfaces, legacy systems, unusual ports, and orphaned DNS.

4. 04

   Diff later runs and investigate new or changed assets.

5. 05

   Route confirmed exposure to the owner with evidence and remediation context.