How I Run a Recon Audit: Real Methodology Step by Step

Before any exploit gets fired, before any shell gets popped, there's recon. Most breaches don't start with some exotic zero-day — they start with publicly available information that nobody thought to lock down. An open S3 bucket. An employee's email format guessed from LinkedIn. A subdomain still pointing at an old, unpatched staging server. The exploit is often the easy part. Finding the door is the real work, and it's the part most people never see.

Here's the methodology I actually run on engagements, broken into the three phases that matter: passive recon, OSINT gathering, and active recon. Nothing here is exotic — it's disciplined, systematic use of tools that are free or nearly free. That's what makes it dangerous in the wrong hands.

Phase 1: Passive Recon

Passive recon means gathering information without ever touching the target's infrastructure directly — no packets sent to their servers, no logs generated on their end. This is where every engagement starts because it's zero-risk and often reveals more than people expect.

WHOIS and DNS Records

WHOIS lookups reveal domain registration details — registrant info (when not redacted), registrar, creation date, and name servers. DNS records (A, MX, TXT, CNAME) map out mail providers, hosting providers, and third-party services in use, often revealing SPF records that list every mail relay a company trusts.

Shodan and Censys

Shodan.io indexes internet-connected devices — servers, webcams, industrial control systems, exposed databases — searchable by IP, organization, or service banner. Censys does similar internet-wide scanning with a different data set. Both let you find exposed infrastructure tied to an organization without sending it a single packet yourself.

Certificate Transparency Logs

Every SSL/TLS certificate issued gets logged publicly in Certificate Transparency (CT) logs. Searching CT logs (via crt.sh or similar) surfaces subdomains an organization has issued certificates for — including forgotten staging environments, internal tools, and dev servers that were never meant to be public-facing.

Phase 2: OSINT Gathering

Once the passive infrastructure map exists, the next phase builds a picture of the people and organization behind it.

theHarvester

theHarvester automates collection of emails, subdomains, employee names, and IPs from public sources — search engines, PGP key servers, and certificate transparency logs — in a single command.

LinkedIn for Org Structure

LinkedIn reveals org charts for free. Job titles, department sizes, tech stack mentioned in job postings ("looking for a DevOps engineer with Kubernetes and Okta experience" tells you exactly what's in their stack), and employee tenure all feed into a target profile.

Google Dorking

Advanced search operators narrow results to exactly what's useful for an engagement.

Wayback Machine

The Internet Archive's Wayback Machine preserves old versions of pages — including pages that have since been taken down for security reasons. Old API documentation, deprecated endpoints, and forgotten admin panel URLs frequently surface here long after the live site has been "cleaned up."

Maltego

Maltego visualizes relationships between entities — domains, IPs, email addresses, social profiles, organizations — as a graph. It turns a pile of disconnected OSINT data points into a relationship map that makes patterns and connections obvious at a glance.

Phase 3: Active Recon

Active recon involves direct interaction with target systems — still non-intrusive and typically authorized under the engagement's rules of engagement, but now the target's logs will show activity.

Nmap Scanning

Nmap remains the standard for port scanning, service identification, and OS fingerprinting.

This runs a full port scan (-p-) with service version detection (-sV) and default scripts (-sC), revealing open ports, running services, and version numbers that map directly to known CVEs.

Banner Grabbing

Many services announce their software and version in a banner on connection. A simple nc target.com 21 against an FTP port, for example, often returns the exact server software and version — instantly narrowing the search for known exploits.

Subdomain Enumeration

Tools like Subfinder and Amass automate subdomain discovery by querying certificate transparency logs, DNS brute-forcing, and public APIs simultaneously, surfacing forgotten subdomains far faster than manual searching.

What I Document

By the end of recon, the deliverable is a target profile that includes:

• IP ranges — full scope of owned and hosted infrastructure
• Open ports and services — with version numbers mapped to known vulnerabilities
• Email address formats — enabling accurate guesses for any employee name
• Employee names and roles — for social engineering risk assessment
• Tech stack — CMS, cloud provider, frameworks, and third-party SaaS tools in use
• Third-party integrations — payment processors, analytics, CDNs, and any vendor with access to target systems

What Attackers Do With This

The exact same recon output that makes a professional pen test report also makes a devastatingly effective attack plan in the wrong hands.

Spear phishing with real employee names. An email that references a real manager's name, a real project, and a real internal tool is far more convincing than a generic phishing blast — and recon is where all three details come from.

Targeting exposed admin panels. That forgotten staging subdomain found via certificate transparency logs is often running an outdated CMS with known, unpatched vulnerabilities and a default admin login nobody remembered to change.

Credential stuffing with breached emails. Once real employee email addresses are confirmed, attackers cross-reference them against breach databases, testing reused passwords against corporate SSO, VPN, and email portals.

Recon is not glamorous. It's methodical, patient, and almost entirely legal to perform. That's exactly why it works — and why every serious security program treats external recon exposure as a first-class risk, not an afterthought.