External reconnaissance
External reconnaissance focuses on identifying systems, services, identities, and trust relationships that are reachable from outside the target environment. The purpose of external reconnassiance is not exploitation, but to understand exposed assets well enough to make deliberate initial access decisions.
Strategic context
From an attacker's perspective, external reconnaissance is conducted to narrow the external attack surface to a small number of high potential entry points. Effective external reconnaissance reduces wasted effort and limits unncecessary noise. It also helps the attacker distinguish between systems that are merely exposed and those that may be exploitable.
For security leaders, this process is how attackers seem to have information about target networks long before exploitation occurs. Much of that understanding comes from exposed information that helps attackers understand a target. Reduction of exposed information is an important step in hardening an attack surface.
What information matters?
Good reconnaissance focuses on collecting information that can be used to inform later decisions.
High value information includes:
Infrastructure - details such as domains, IP ranges, hosting providers, and cloud resources
Technologies - web applications, operating systems, frameworks, authentication, application programming interfaces (API), and third-party services
Business practices - usernames, email formats, job titles, contact information, and organization structure
Trust - relationships between systems and services that may enable additional access
Remember, the purpose of reconnaissance is to help identify viable attack paths and should not be judged by the volume of information collected.
Execution examples
External reconnaissaince is performed using a combination of passive and active discovery techniques. Information discovered using passive techniques commonly highlights where active effort should be applied.
Passive discovery
Passive techniques allow an attacker to gather information about the target without directly interacting with target-owned systems.
Examples:
Web sources:
Allows searching for computers and IoT devices
May reveal items that should be in scope but were not included by the client
Breach databases
Social media
Passive discovery can reveal:
Naming conventions
Hosting providers
Third party services
Technology stacks and frameworks
Cloud service usage
This information helps shape our understanding of possible access paths before active techniques are used.
Active discovery
Active discovery helps validate host and service reachability and exposure. For obvious reasons active discovery should be explicitly authorized and in scope.
Host and service discovery
(Important) Active discovery scans vary widely in available options and can quickly become very noisy. Be aware of the OPSEC requirements for your particular scenario and plan accordingly.
See Nmapfor more scanning options
VHOST and subdomain enumeration
Identifying additional hostnames often reveals additional attack surface such as login portals, legacy applications, and internal naming conventions.
Username enumeration
Before interacting with authentication attackers commonly attempt to determine username format and collect possible identities. The goal during this stage is collecting information, not credential validation.
Common objectives include:
Identifying username formats
Extracting employee names
Building user lists for social engineering campaigns
Web sources:
Company website(s)
Breach databases
Social media
GitHub profiles
Hunter - Sales tool that allows you to search for email addresses by domain. I prefer using the browser extension while viewing target domains.
Web enumeration
Web applications commonly represent a target's largest externally exposed attack surface. Web enumeration focuses on:
Available paths and endpoints
Authentication portals
Default installations
Exposed files
Common misconfigurations
Example workflow:
Resist the urge to become overly reliant on tools, often a manual walkthrough of available applications while using a proxy interceptor will reveal ample information.
Common mistakes
Over collection - gathering information without clear objectives or intent
Checklist bias - treating information gathering as a list of tasks rather than a process to inform decision making
Confirmation bias - interpreting information only in ways that support an existing narrative
Recongizing these mistakes early prevents wasted effort.
Operator notes
External reconnaissance should help narrow future attack choices
Automation accelerates discovery but does not replace sound judgement
When additional data stops informing decisions, it's time to move on
Resist the urge to attempt to exploit viable attack paths at this point
Last updated