Hack Like a Pro: Reconnaissance with Recon-Ng, Part 1 (Getting Started) « Null Byte :: WonderHowTo

Welcome back, my novice hackers!As many of you know,reconis crucial to a successful hack/pentest. In most cases, hackers spend more time doing good reconnaissance than actually hacking. Without proper recon, you are simply guessing at what type of approach or exploit is going to work and, as a result, your time is wasted without any useful outcomes.I have anentire serieshere on Null Byte on the various ways to approach reconnaissance, including such key tools as:NmapHping3ShodanNetcraftMaltegoFOCApygeoipWhoisI encourage you to start with these reconnaissance tools and others before even considering hacking/exploitation.In recent years, a brand new reconnaissance framework has become available to us that leverages many of the tools we are already using, but makes them far more powerful. This tool,Recon-ng, was developed byTim Tomeswhile at Black Hills Information Security. He developed it as a Python script and tried to model its usage afterMetasploit, making it easy for a pentester with Metasploit skills to use Recon-ng. It is built into Kali, so there's no need to download or install anything.Let's explore its many and powerful capabilities a bit here.Step 1: Starting Recon-NgFire up Kali, open a terminal, and type:kali > recon-ngThis will open a splash screen like below.Note that the splash screen lists the number of modules by type. UnlikeSET, but rather like Metasploit, we use commands and not numbers to use Recon-ng.Step 2: Viewing CommandsAt the prompt, let's typehelpin order to look at the commands we can use in Recon-ng.recon-ng > helpNote that many of these commands are nearly identical to Metasploit including back, set, use, search, show, and unset.Step 3: Showing ModulesTo see all the modules in Recon-ng, we can type:recon-ng > show modulesSince there are 84 modules in Recon-ng, I can't fit them all on one screen, or for that matter, even two.Step 4: Viewing KeysOne of the strengths and beauties of Recon-ng is the use of various application programming interfaces (APIs) to extract useful recon information. For instance, Recon-ng can use Bing, Google, Facebook, Instagram, LinkedIn, and other online applications once you get the API key. With that key, you have almost unlimited access to that application.To see what API keys Recon-ng can use, type:recon-ng > keys listAs we can see, these are all the API keys that Recon-ng can use. Some are free and some you must pay for.When you obtain an API key and you want to add it to Recon-ng for use, you simply add it to the keys. For instance, if I received an API key from Facebook and that key was "123456", I could add it to Recon-ng by typing:recon-ng > keys add facebook_api 123456Now when you list the keys, you can see that yourfacebook_apikey is listed. This means that when you use the Facebook recon module, it will automatically use this key to access Facebook like a Facebook application would.Step 5: Using Recon-NgNow that we have explored a bit of Recon-ng, let's try using one the modules that doesnotrequire an API key. There are many, but let's use one for scanning for XSS (cross-site scripting) vulnerabilities called XSSposed. We can load this module by typing:recon-ng > use recon/domains-vulnerabilities/xssposedThis loads the module into memory and makes it ready for use. Let's get some info on this module by typing:recon-ng > show infoNote the similarity to Metasploit syntax.As you can see above, the only option we need is the website we want to scan. Let's scan our favorite website, WonderHowTo.com, to see whether it has any known XSS vulnerabilities.First, set the source:recon-ng > set source wonderhowto.comThen tell Recon-ng to run:recon-ng > runRecon-ng uses XSSposed to then scan the site for known XSS vulnerabilities. Note that XSSposed found no XSS vulnerabilities in WonderHowTo.com. (Great job, Bryan!)Now, let's try scanning the website of the leading IT security training company in the U.S., SANS.org, which teaches many courses on website and web app security.recon-ng > set source sans.orgrecon-ng > runNotice that our good friends at SANS.org have not secured their own website. We found two vulnerabilities from 2015.Recon-ng is one more tool in our hacker/pentester toolbox that provides us powerful capabilities for gathering necessary info on the target. In future tutorials in this series, we will explore its many varied capabilities, most particularly using APIs to garner key info on our target. So keep coming back, my novice hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Hack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHack Like a Pro:The Hacker MethodologyHack Like a Pro:How to Conduct Passive Reconnaissance of a Potential TargetHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon)How to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsVideo:How to Use Maltego to Research & Mine Data Like an AnalystHack Like a Pro:How to Perform Stealthy Reconnaissance on a Protected NetworkHack Like a Pro:How to Conduct OS Fingerprinting with Xprobe2Hack Like a Pro:How to Get Even with Your Annoying Neighbor by Bumping Them Off Their WiFi Network —UndetectedHack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHow To:Advanced Penetration Testing - Part 1 (Introduction)How to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHack Like a Pro:How to Conduct Passive OS Fingerprinting with p0fHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow To:Conduct Recon on a Web Target with Python ToolsHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)How To:Use BeEF and JavaScript for ReconnaissanceHow To:Bypass a Local Network Proxy for Free InternetHow To:How Hackers Steal Your Internet & How to Defend Against ItTHE FILM LAB:Intro to Final Cut Pro - 02Null Byte:Never Let Us DieHow To:The Official Google+ Insider's Guide Index