Reconnaissance

Information gathering is where every engagement starts No intel means blind attacks and that’s how operations fail before they begin. Reconnaissance covers OSINT , network scanning , service enumeration , asset discovery , and all the pre-attack intel gathering techniques that separate professional engagements from script kiddie guessing games

What you’ll find here:

• Passive Reconnaissance - OSINT , DNS enumeration , certificate transparency , search engine dorking , social media intel , breach data
• Active Reconnaissance - port scanning , service fingerprinting , banner grabbing , firewall enumeration , network mapping
• Analysis - cloud asset discovery , CDN detection , reverse IP lookups , WHOIS , ASN , technology fingerprinting
• Operations - the working checklist and real case studies

first topic => OSINT Introduction

From the 0x1RIS OffSec library - for authorized testing only , Document everything