Use when: Planning web recon engagement — reference to select the right tool for each phase without context switching.
Think Dumber First: Start with passive (WHOIS, CT logs, Wayback, Shodan). Then active (vhost, subdomain brute, crawl, fingerprint). Resist jumping to SQLMap before mapping the full surface.
Skip when: N/A — this is a reference document, not an operational procedure.
Start with: WHOIS → subfinder → dnsx → whatweb → ffuf (dirs) → nikto — in that order
Recon taking too long
Unfocused tooling
Set time-box: 30 min passive, 30 min active enumeration before switching to exploitation
Tools return conflicting information
Different data sources
Trust active results over passive; passive sources lag by hours to days
VPN drops mid-recon
HTB/THM infrastructure issue
Re-establish VPN; resume from last completed tool — save all outputs to files
Results lost after terminal close
No output logging
Always redirect: tool [args] | tee -a output.txt; use screen or tmux
📝 Reporting Trigger
Finding Title: Insufficient Web Application Enumeration Controls
Impact: Lack of web application inventory and perimeter monitoring allows external enumeration to discover attack surface without detection, enabling targeted exploitation of exposed services.
Root Cause: No external attack surface management (EASM) program. Absence of automated monitoring for new subdomain creation, certificate issuance, and web asset changes.
Recommendation: Implement continuous EASM tooling (e.g., Shodan Monitor, SecurityTrails alerts). Conduct quarterly web recon audits. Establish a web asset inventory with ownership tracking.