hacking-101

Rookie Recon

Welcome to Level 2: Rookie Recon!
This phase focuses on reconnaissance — the art of gathering information about your target using open-source tools and passive techniques before attempting any active engagement.

---

🌐 1. OSINT Basics (Open Source Intelligence)

• What is OSINT?
• Why reconnaissance matters in ethical hacking
• Legal & ethical considerations
• Types of intel: people, companies, websites, infrastructure
• Real-world examples

---

🔎 2. Domain & Network Reconnaissance

WHOIS Lookups

• Understand domain registration info
• Tools:
  • whois
  • Whoxy
  • ICANN Lookup

DNS Enumeration

• Discover subdomains, mail servers, and name servers
• Tools:
  • nslookup
  • dig
  • host
  • dnsenum
  • Fierce

IP Lookup

• Reverse DNS
• Geolocation
• ASN info

---

🗺️ 3. Host & Network Scanning

Nmap Basics

• Port scanning: TCP vs UDP
• Service detection (-sV)
• OS detection (-O)
• Stealth scanning (-sS)
• Intro to NSE (Nmap Scripting Engine)

Banner Grabbing

• Reveal service info using:
  • netcat
  • telnet
  • curl

---

⚙️ 4. Recon Tools Overview

• 🛠️ theHarvester
• 🕵️‍♂️ Recon-ng
• 🧠 SpiderFoot
• 🌐 Shodan
• 🔎 Censys
• 🌍 Amass
• 🧬 Maltego

---

👥 5. People & Organization Footprinting

• Email & username discovery
• Useful tools:
  • Hunter.io
  • HaveIBeenPwned
  • Pipl (some features paid)
• LinkedIn scraping & employee discovery
• Social media recon
• Google Dorking for specific info
• Building a digital footprint

---

⚖️ 6. Manual vs Automated Recon

• Why automation isn’t everything
• How human intuition improves results
• When to go manual and verify

---

🧪 7. Practical Labs

• 🎓 TryHackMe – OSINT Basics
• 🎓 TryHackMe – Intro to Recon
• 🧩 Hack The Box recon-focused machines
• 🕵️‍♀️ CTFs (e.g. OSINT Dojo, Trace Labs)

---

📚 8. Resources & Further Learning

• SOCMIntelligence
• OSINT Framework
• Awesome-OSINT GitHub List
• Pentest Bookmarks (by PayloadAllTheThings)

---