# Module Pentest Recon - Rex::Recon

> **Parent Agent**: Rex (pentest.md)
> **Sources**: hard-hatter-hacking.json, bb-kali-linux-pentest-full.json, Web Research 2025
> **Focus**: OSINT, Reconnaissance Passive/Active, Footprinting

---

## Specialisation

Ce module couvre la phase de reconnaissance (Phase 1 PTES):
- OSINT (Open Source Intelligence)
- Google Dorks et moteurs de recherche
- Shodan, Censys, ZoomEye
- DNS/WHOIS Enumeration
- Network Scanning (Nmap, Masscan)
- Subdomain Discovery
- Metadata Extraction

---

## OSINT - Open Source Intelligence

### Methodologie (source: hard-hatter-hacking.json ch.7)

```markdown
## Pourquoi l'OSINT?

1. **Legal** - Navigation sources ouvertes n'est pas un delit
2. **Sigileux** - Aucun paquet envoye a la cible
3. **Economique** - Temps + creativite + outils gratuits
4. **Complet** - Souvent plus de resultats qu'un exploit technique

## Sources Principales OSINT

1. Moteurs de recherche: Google, Bing, Yandex, DuckDuckGo
2. Google Dorks: requetes avancees pour data sensibles
3. Reseaux sociaux: LinkedIn, Twitter/X, Facebook, Instagram
4. Repositories code: GitHub, GitLab, Bitbucket
5. Fichiers publics: PDF, DOCX, XLSX sur serveurs mal configures
6. Metadonnees: info cachee dans photos et documents
7. Shodan/Censys: moteurs devices connectes
8. WHOIS/DNS: info domaines et serveurs
```

### Google Dorks - Reference Complete

```bash
# Recherche fichiers sensibles
site:target.com filetype:pdf
site:target.com filetype:xls
site:target.com filetype:doc
site:target.com filetype:sql
site:target.com filetype:log
site:target.com filetype:bak
site:target.com filetype:config

# Directory listing
site:target.com intitle:"index of"
site:target.com intitle:"Index of" inurl:/admin
site:target.com intitle:"Index of" passwords

# Fichiers de configuration
site:target.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini
site:target.com filetype:env "DB_PASSWORD"
site:target.com filetype:yml password

# Credentials exposed
site:target.com inurl:wp-config.php
site:target.com inurl:configuration.php
site:target.com inurl:config.php
"password" filetype:xls site:target.com
"api_key" OR "apikey" site:target.com

# Cameras et IoT
inurl:ViewerFrame?Mode=
inurl:/view.shtml
intitle:"Live View / - AXIS"

# Panels d'admin
site:target.com inurl:admin
site:target.com inurl:login
site:target.com inurl:dashboard
site:target.com intitle:"admin panel"

# Erreurs et debug
site:target.com intext:"sql syntax near"
site:target.com intext:"Warning: mysql"
site:target.com intext:"Error in your SQL syntax"
site:target.com filetype:log intext:error

# Cloud Storage
site:s3.amazonaws.com "target"
site:blob.core.windows.net "target"
site:storage.googleapis.com "target"
site:digitaloceanspaces.com "target"
```

### GitHub Recon

```bash
# Recherches GitHub pour credentials
"DB_PASSWORD" repo:target-org
"api_key" repo:target-org
"secret" filename:.env repo:target-org
"password" extension:yml repo:target-org
"AWS_ACCESS_KEY_ID" repo:target-org
"PRIVATE KEY" repo:target-org

# Trufflehog - Scanner secrets Git
trufflehog git https://github.com/target-org/repo.git

# GitLeaks
gitleaks detect --source=/path/to/repo

# GitDorker (automatisation)
python3 gitdorker.py -tf tokens.txt -q target.com
```

### Reseaux Sociaux OSINT

```markdown
## LinkedIn Intelligence

- Noms et postes des employes
- Structure interne de l'entreprise
- Technologies utilisees (profils techniques)
- Ancien employes (info historique)
- Emails professionnels patterns

## Twitter/X
- Comptes officiels et employes
- Mentions @target
- Hashtags #target
- Geolocalisations

## Outils
- theHarvester: emails, noms, subdomains
- Maltego: visualisation relations
- SpiderFoot: OSINT automatise
- Recon-ng: framework modulaire
```

---

## SHODAN & MOTEURS IoT

### Shodan Queries (source: hard-hatter-hacking.json ch.8)

```bash
# Recherches basiques
apache 2.2.3 country:"FR"
nginx country:"BE"
port:22 country:"CA"

# Services specifiques
port:21 anonymous    # FTP Anonymous
port:23             # Telnet
port:3389 country:"FR"  # RDP France
port:5900           # VNC
port:27017 "MongoDB" # MongoDB

# Cameras IP
port:554 has_screenshot:true
webcam country:"FR"
"Server: yawcam"

# Systemes industriels (SCADA/ICS)
port:502 Modbus
port:47808 BACnet
"Siemens" port:102

# Bases de donnees exposees
port:27017 "MongoDB Server Information" -authentication
port:9200 "elasticsearch"
port:6379 "redis_version"

# Par organisation
org:"Target Company" port:443
hostname:target.com

# Vulnerabilites connues
vuln:CVE-2021-44228  # Log4Shell
vuln:CVE-2017-0144   # EternalBlue
http.favicon.hash:-1368248476  # Jenkins

# API Python
import shodan
api = shodan.Shodan("YOUR_API_KEY")
results = api.search("apache 2.4.49 country:US")
for service in results['matches']:
    print(f"{service['ip_str']}:{service['port']}")
```

### Alternatives Shodan

| Outil | Description | URL |
|-------|-------------|-----|
| **Censys** | Inventaire global devices + certs TLS | censys.io |
| **ZoomEye** | Moteur chinois, forte couverture Asie | zoomeye.org |
| **FOFA** | Recherche avancee infrastructure | fofa.info |
| **BinaryEdge** | Intelligence menaces temps reel | binaryedge.io |
| **GreyNoise** | Filtrage bruit internet | greynoise.io |

---

## DNS & WHOIS ENUMERATION

### WHOIS Lookup

```bash
# Info domaine
whois target.com

# Info IP
whois 8.8.8.8

# Registrar, dates, contacts
# Nameservers
# Admin/Tech contacts (RGPD limite)
```

### DNS Enumeration

```bash
# Enregistrements DNS basiques
dig target.com ANY
dig target.com A
dig target.com MX
dig target.com NS
dig target.com TXT
dig target.com AAAA

# Zone transfer (si misconfigure)
dig axfr @ns1.target.com target.com

# Reverse DNS
dig -x 192.168.1.1

# DNSRecon
dnsrecon -d target.com -t std
dnsrecon -d target.com -t brt -D wordlist.txt

# Fierce
fierce --domain target.com

# Host
host -t ns target.com
host -t mx target.com
host -l target.com ns1.target.com
```

### Subdomain Discovery

```bash
# Sublist3r
sublist3r -d target.com

# Amass (le plus complet)
amass enum -d target.com
amass enum -active -d target.com -brute

# Subfinder
subfinder -d target.com -all

# Assetfinder
assetfinder --subs-only target.com

# crt.sh (Certificate Transparency)
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Bruteforce DNS
gobuster dns -d target.com -w /usr/share/wordlists/dns.txt

# Knockpy
knockpy target.com

# Combiner les resultats
cat amass.txt subfinder.txt assetfinder.txt | sort -u > all_subdomains.txt
```

---

## NETWORK SCANNING

### Host Discovery (source: bb-kali-linux-pentest-full.json ch.3)

```bash
# Ping sweep basique
ping -c 1 192.168.1.1

# Nmap host discovery (Security Agent & Nanny)
nmap -sn 192.168.1.0/24

# ARP scan (reseau local)
arp-scan 192.168.1.0/24
arp-scan -l

# Netdiscover
netdiscover -r 192.168.1.0/24

# Bash ping sweep
for ip in $(seq 1 254); do
    ping -c 1 192.168.1.$ip | grep "64 bytes" &
done

# Nmap sans ICMP (si bloque)
nmap -sn -PS22,80,443 192.168.1.0/24
nmap -sn -PA22,80,443 192.168.1.0/24
```

### Port Scanning

```bash
# SYN Scan - defaut, stealth
nmap -sS 192.168.1.1

# Connect Scan (si pas root)
nmap -sT 192.168.1.1

# UDP Scan (lent)
nmap -sU 192.168.1.1
nmap -sU -T5 192.168.1.1  # Plus rapide

# Scan tous les ports
nmap -p- 192.168.1.1
nmap -p 1-65535 192.168.1.1

# Ports specifiques
nmap -p 22,80,443,8080 192.168.1.1
nmap -p 1-1000 192.168.1.1

# Top ports
nmap --top-ports 100 192.168.1.1

# Timing templates
# T0 = Paranoid (IDS evasion)
# T1 = Sneaky
# T2 = Polite
# T3 = Normal (defaut)
# T4 = Aggressive
# T5 = Insane
nmap -T4 192.168.1.1

# Masscan (ultra rapide)
masscan 192.168.1.0/24 -p 80,443,22 --rate=1000
masscan 0.0.0.0/0 -p 443 --rate=10000  # Internet scan
```

### Service & Version Detection

```bash
# Version detection
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Aggressive scan (version + OS + scripts + traceroute)
nmap -A 192.168.1.1

# Script scan
nmap -sC 192.168.1.1
nmap --script=default 192.168.1.1

# Scripts specifiques
nmap --script=vuln 192.168.1.1
nmap --script=http-enum 192.168.1.1
nmap --script=smb-vuln* 192.168.1.1
```

### Banner Grabbing

```bash
# Netcat
nc -nv 192.168.1.1 21
nc -nv 192.168.1.1 22
nc -nv 192.168.1.1 80

# Telnet
telnet 192.168.1.1 21

# Curl (HTTP)
curl -I http://192.168.1.1

# Nmap banner
nmap -sV --script=banner 192.168.1.1
```

### Nmap Scripting Engine (NSE)

```bash
# Categories de scripts
# auth, broadcast, brute, default, discovery, dos, exploit
# external, fuzzer, intrusive, malware, safe, version, vuln

# Lister scripts disponibles
ls /usr/share/nmap/scripts/

# Scripts par categorie
nmap --script=vuln 192.168.1.1
nmap --script=safe 192.168.1.1
nmap --script=discovery 192.168.1.1

# Scripts specifiques
nmap --script=http-title 192.168.1.1
nmap --script=ssl-heartbleed 192.168.1.1
nmap --script=smb-os-discovery 192.168.1.1

# Avec arguments
nmap --script=http-brute --script-args http-brute.path=/admin 192.168.1.1
```

---

## METADATA EXTRACTION

### ExifTool

```bash
# Extraire metadonnees image
exiftool image.jpg

# Extraire de tous les fichiers
exiftool -r /path/to/files/

# Info sensibles possibles:
# - Camera Model
# - GPS Latitude/Longitude
# - Author/Creator
# - Software used
# - Create/Modify dates

# Supprimer metadonnees (defense)
exiftool -all= document.pdf
exiftool -all= image.jpg
```

### FOCA

```bash
# Extraction metadata automatisee depuis documents web
# Windows tool, alternatives Linux:

# metagoofil
metagoofil -d target.com -t pdf,doc,xls -o output/

# Sortie: usernames, software versions, paths internes
```

---

## OUTILS RECON COMPLETS

### theHarvester

```bash
# Emails, noms, subdomains, IPs
theHarvester -d target.com -b all
theHarvester -d target.com -b google,bing,linkedin

# Sources disponibles:
# baidu, bing, bingapi, certspotter, crtsh, dnsdumpster
# duckduckgo, github-code, google, hackertarget, hunter
# intelx, linkedin, netcraft, otx, rapiddns, shodan
# spyse, sublist3r, threatcrowd, trello, twitter
# urlscan, virustotal, yahoo
```

### Recon-ng

```bash
# Framework modulaire OSINT
recon-ng

# Commandes de base
[recon-ng] > marketplace search
[recon-ng] > marketplace install all
[recon-ng] > workspaces create target
[recon-ng] > db insert domains target.com

# Modules utiles
[recon-ng] > modules load recon/domains-hosts/hackertarget
[recon-ng] > run
[recon-ng] > modules load recon/hosts-hosts/resolve
[recon-ng] > run

# Exporter resultats
[recon-ng] > modules load reporting/html
[recon-ng] > run
```

### SpiderFoot

```bash
# OSINT automatise complet
spiderfoot -l 127.0.0.1:5001

# Interface web sur http://127.0.0.1:5001
# Scans: Passive, Investigate, Footprint, All
```

---

## PORTS COMMUNS - Reference

| Port | Service | Protocol |
|------|---------|----------|
| 21 | FTP | TCP |
| 22 | SSH/SCP | TCP |
| 23 | Telnet | TCP |
| 25 | SMTP | TCP |
| 53 | DNS | TCP/UDP |
| 80 | HTTP | TCP |
| 110 | POP3 | TCP |
| 139 | NetBIOS | TCP |
| 143 | IMAP | TCP |
| 443 | HTTPS | TCP |
| 445 | SMB | TCP |
| 1433 | MSSQL | TCP |
| 3306 | MySQL | TCP |
| 3389 | RDP | TCP |
| 5432 | PostgreSQL | TCP |
| 5900 | VNC | TCP |
| 6379 | Redis | TCP |
| 8080 | HTTP Alt | TCP |
| 27017 | MongoDB | TCP |

---

## COMMANDES MODULE

| Commande | Description |
|----------|-------------|
| `*osint-full` | OSINT complet sur cible |
| `*subdomain-enum` | Enumeration subdomains |
| `*dns-recon` | Reconnaissance DNS |
| `*port-scan` | Scan ports Nmap |
| `*shodan-search` | Recherche Shodan |
| `*metadata-extract` | Extraction metadonnees |
| `*google-dork` | Generation Google dorks |

---

## WORKFLOW RECON

```
1. OSINT PASSIF
   ├── Google Dorks
   ├── Shodan/Censys
   ├── theHarvester
   ├── LinkedIn/Social
   └── GitHub Leaks

2. DNS ENUMERATION
   ├── WHOIS
   ├── Zone Transfer
   ├── Subdomain Discovery
   └── Reverse DNS

3. NETWORK SCANNING
   ├── Host Discovery
   ├── Port Scanning
   ├── Service Detection
   └── OS Fingerprint

4. METADATA
   ├── Documents publics
   ├── Images
   └── ExifTool analysis
```

---

## CONTRE-RECON (Defense)

```markdown
## Reduire Surface d'Attaque

1. **Reseaux sociaux**: Ne pas publier technos internes ni roles sensibles
2. **GitHub**: Repositories prives, jamais de secrets en clair
3. **Documents**: Supprimer metadonnees avant publication
4. **Serveurs**: Desactiver banners et versions publiques
5. **Shodan**: Surveiller regulierement ce qu'un attaquant voit
6. **DNS**: Desactiver zone transfers, limiter records publics
7. **Emails**: Utiliser catchall, pas de pattern predictible
```

---

## REFERENCES

- **hard-hatter-hacking.json** - Ch.6-10 (Fingerprinting, OSINT, Shodan)
- **bb-kali-linux-pentest-full.json** - Ch.3-4 (Network Scanning, Information Gathering)
- PTES Technical Guidelines
- OWASP Testing Guide
- Nmap Reference Guide
