Web/HTB Recon Checklist

1. Passive Recon / OSINT

• [ ] whois target.com — registrar, name servers, registrant org, creation/expiry dates
• [ ] Reverse WHOIS on registrant email/org (WhoisXML, ViewDNS) to find sibling domains
• [ ] dig target.com ANY, dig MX/TXT/NS target.com — mail servers, SPF/DKIM, hosting hints
• [ ] IP history / ASN lookup (Shodan, Censys, BGP.he.net) — real origin IP behind CDN/WAF
• [ ] Google/Yandex/Bing dorking:
  • site:target.com ext:php inurl:id=
  • site:target.com intitle:"index of"
  • site:target.com ext:log | ext:env | ext:sql
  • site:pastebin.com "target.com"
• [ ] GitHub/GitLab dorking for leaked creds, internal endpoints, config files (gitleaks, trufflehog, github-search)
• [ ] Check public breach data (leaked credentials tied to employee emails) — only if in scope

2. Subdomain Enumeration

DNS-based

• [ ] subfinder -d target.com -all -silent -o subf.txt -v
• [ ] assetfinder -subs-only target.com > asset.txt
• [ ] dnsenum target.com

Add all Enumerated/Collected subdomains from different tools in different files into one file with unique subdomains, that may be subdomains.txt

Run : cat subf.txt haksubs.txt asset.txt | sort -u > subdomains.txt

Now, will check the identified subdomains are active or not - Run : httpx -l subdomains.txt -o activesubs.txt -threads 200 -status-code -follow-redirects

To seperate ones without a status code from ones with a status code use: cat activesubs.txt | awk -F'//' '{print $2}' | awk '{print $1}' | sort > clean_active.txt This returns ones without any status code, which u can then add to your wordlist for VHOST fuzzing

You’ll able to see the active subdomains only, on which you can start finding bugs and all.

Certificate Transparency (CT) logs