Hi, folks.
I'm Tim Tomes,
and thank you for joining me on Pluralsight to learn more about the technical
information‑gathering tool for red teams called Recon‑ng.
Recon‑ng is created and maintained by yours truly,
Tim Tomes, also known Ianmaster53 and, as stated on the tool's website,
is a feature‑rich reconnaissance framework designed with the goal of
providing a powerful environment to quickly and thoroughly conduct
open source web‑based reconnaissance.
Now I would be remiss if I didn't draw attention to the design of the logo.
Recon‑ng is a framework made up of many pieces,
and those many pieces are called modules,
and each of these blocks here in the logo represents
the modular nature of Recon‑ng.
Those modules are designed by the community.
And so while Tim Tomes is the creator and
maintainer of the framework core itself,
the tool's true life blood and functionality is through
the modules that employ that framework, and those are created by the community.
So I'd like to take this opportunity to thank each and everyone
that has or will be contributing to the project as it just simply
would not be what it is without them.
Thank you.
So to elaborate further on what Recon‑ng is.
Recon‑ng is an open source framework,
which means that the source code is open and available to use in
both personal and commercial environments,
and it provides a powerful environment to automate
open source web‑based reconnaissance.
I want to draw your attention here to the term automate
because reconnaissance historically has been seen as that
step in the methodology that, when we we're restricted for time,
has the least perceived value and often gets dropped.
And so the goal, the design goal behind Recon‑ng was to automate so much of that,
so that rather than just skipping over that step of the methodology,
we can do it faster, and we can do it better,
and we can collect that information that we may possibly need quicker,
and therefore we aren't tempted to skip that particular step.
And so that's kind of the design goal behind Recon‑ng.
Now you can find the tool at recon‑ng.com,
and there you can either download it as a package,
or you can clone the repository and use it that way.
There's also a wiki that goes through how to install and configure,
use, and also develop modules for Recon‑ng.
So if you're interested in that stuff, it's a really,
really good resource to go and learn how to use the tool and then if
you want to develop how to build modules that didn't take advantage
of third party resources of information.
It is cross platform for the most part.
It runs on Python 3.
And so if you can install Python 3, then you'll be able to run Recon‑ng.
The one exception is probably Windows.
There are some underlying file system interactions between Python and
the operating system that don't always work so well when you try to do
them both in Linux and Windows environments.
And so while Windows doesn't have 100% support, macOS and Linux does.
And it just tries to be that one‑stop shop that removes the need to
maintain a collection of information‑gathering scripts because there
are a ton of scripts that you can pull down and use to do some of the
same things that Recon‑ng does.
But the problem is you have all of these tools maintained
by a large group of different people.
They're at various stages of functionality.
You end up spending a lot of time figuring out how to
get that information into one place,
how to get the scripts working if they're broken,
so on and so forth.
So what Recon‑ng tries to do is say hey,
this is one place you can come to do it all.
The information is collected together, gathered together,
stored together, and you can analyze it,
export it, do whatever you need to do with it in one place.
And so that was another one of the major design goals behind Recon‑ng.
So where does Recon‑ng fall in the cyber kill chain?
Well, obviously it's a reconnaissance tool,
so it's going to fall right here at the reconnaissance step of the kill chain.
Now the interesting thing about reconnaissance is it's the first thing that we
do. It's the first pieces of information that we collect. And what we do with
that information is it allows us to begin making assumptions about all these
later steps of the kill chain. And so reconnaissance actually sticks with us
the whole way.
The information that we gain with reconnaissance will then
move into these later steps and begin to validate that
information, validate it as being true,
validate it as being false, and we'll begin to build on that.
And at every step, we have a clearer picture of our target environment,
and it all starts with the information that we collect during the
reconnaissance phase. So the MITRE ATT&CK coverage for any
information‑gathering tool is going to be pretty broad.
And as Recon‑ng can support many of these tactics that you see listed here,
it really shines in its ability to quickly and effectively gather
information about technical assets and people.
Recon‑ng excels at harvesting host information,
and it does this for both things like scope validation and target selection.
And it can use those assets than to determine various
technologies that might be employed by the target.
It also does a really good job of identifying personnel and specifically
the personnel that have authority and privilege because those were going
to be important high‑value targets for our particular engagement. Before
we jump headfirst into reconnaissance, there are two forms of recon that I
want to discuss as they affect when red teams can employ certain tools and
techniques, and those two forms are passive versus active reconnaissance.
So what is passive reconnaissance? Well passive reconnaissance is when some
third party resource makes direct contact with the target or its assets or
its people to collect information about it.
They then store that information and make it available to third parties.
And we, as the third party, will query the resource for that
information and learn about our target through that resource.
This is passive because we're not making any direct contact
with the target or the target environment.
An example of this would be pulling information from a domain registrar.
So when the target registers a domain with a registrar, it has to
provide contact information for different types of contacts that
go along with that particular domain.
Well what we can do is is as a third party, we can query those registrars or
we can query other resources that have the information from those registrars
to gain access to information like full names,
email addresses, roles, etc.
And that's passive because we're not making any direct contact with the
target. On the other hand, active reconnaissance would be something where
we do make direct contact with the target.
Now that contact is not malicious.
That contact will probably something along the lines of normal internet
behavior, but it is contact that is attributable to us.
So an example of this would be if we were trying to harvest hosts through the
DNS protocol. If that authoritative DNS server sitting on the target's
environment, every time we make a request for a host that's not cached in a
DNS server that somewhere along the pathway, then our request is going to go
all the way to that authoritative DNS server, hit the target environment
before we get an answer back.
Now that may not be seen as malicious, but the reality is we are making contact.
At that point in time, it is attributable. And so that
would be considered active reconnaissance.
Now the reason why it's important to make this distinction is
because passive reconnaissance can occur at any time.
We can do this during scoping.
We can do this during planning.
We can do this just in general.
We can do it at any point in time.
But active reconnaissance should be reserved for when we actually
have authority to conduct activities against that particular
target simply because even though we don't intend for our traffic
to be malicious in nature, it can be perceived as such.
And so we definitely want to take this active versus passive
reconnaissance thing into consideration.
So with all that being said, let's dive in and begin exploring Recon‑ng.