THB-WR201 : Web Reconnaissance & Information Gathering

M01 : Reconnaissance Methodology & Planning

Role of Reconnaissance in the penetration testing lifecycle

Difference between Information Gathering and Enumeration

Difference between Passive and Active Reconnaissance

Defining Scope and Rules of Engagement

Designing a Reconnaissance Workflow

Managing collected data

M02 : Passive Reconnaissance & OSINT

Searching for domain and organization information

Reviewing public sources

Analyzing Certificate Transparency

Examining historical website information

Extracting information from specialized search engines

Reviewing information published on GitHub

Identifying assets related to the organization

M03 : Domain, DNS & Subdomain Enumeration

DNS Record Enumeration

Examining A, AAAA, MX, NS, TXT, and CNAME records

Subdomain Enumeration

Checking for Wildcard DNS

Identifying DNS Misconfigurations

Discovering active Subdomains

Validating results and removing False Positives

Recommended tools: Amass, Subfinder, Assetfinder, DNSx, crt.sh

M04 : HTTP, TLS & Technology Fingerprinting

Analyzing HTTP Headers

Examining TLS Certificates

Identifying the Web Server

Detecting CMS and Frameworks

Checking for CDN and Reverse Proxy

Identifying server-side and client-side technologies

Tools: httpx, WhatWeb, Wappalyzer, curl, testssl.sh

M05 : Web Content & Directory Discovery

Directory Enumeration

File Discovery

Checking for sensitive files in the authorized environment

Examining common and undocumented paths

Analyzing Status Codes

Reviewing unusual Responses

Customizing Wordlists based on the target

Tools: FFUF, Gobuster, Feroxbuster

M06 : URL, Endpoint & Parameter Discovery

Collecting URLs from various sources

Historical URL Discovery

Identifying input parameters

Extracting accessible Endpoints

Discovering API paths

Removing duplicate URLs

Categorizing Endpoints

Tools: GAU, Waybackurls, Katana, Burp Suite

M07 : JavaScript, API & Hidden Asset Discovery

Analyzing JavaScript files

Identifying API Endpoints

Extracting undocumented paths

Discovering unintended sensitive information in public files

Examining Source Maps

Identifying API Versions

Analyzing the Frontend–Backend communication structure

M08 :Active Reconnaissance & Validation

Active Subdomain Enumeration

Directly examining web services

Analyzing Responses

Validating discovered assets

Controlling request rates

Detecting invalid results

Preparing an Attack Surface Inventory

Final course lab

For purchases and further information, please contact us via the following Telegram :

T.me/ThbxSupport