Reconnaissance & Mapping

Fingerprinting, subdomains, directories and reading the front end.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

9/9

1. 00:00Reconnaissance & Mapping. Fingerprinting, subdomains, directories and reading the front end.
2. 00:05Recon is the largest part of real testing: enumerate everything the target exposes before sending a single payload.
3. 00:12The wider the map, the more likely you find the forgotten staging box.
4. 00:17Passive: DNS records, certificate transparency logs, public repos, search operators, archived pages.
5. 00:22Active: subdomain discovery, directory brute forcing, port scanning - in scope only.
6. 00:27Fingerprinting: response headers, cookie names, error pages, framework artefacts.
7. 00:32Read the JavaScript bundles - endpoints, feature flags and sometimes keys live there.
8. 00:37Always check /robots.txt, /sitemap.xml, /.well-known/ and leftover source maps.
9. 00:42Client-side fingerprint — edit the sample and run it in the browser.

Recon is the largest part of real testing: enumerate everything the target exposes before sending a single payload. The wider the map, the more likely you find the forgotten staging box.

• Passive: DNS records, certificate transparency logs, public repos, search operators, archived pages.
• Active: subdomain discovery, directory brute forcing, port scanning - in scope only.
• Fingerprinting: response headers, cookie names, error pages, framework artefacts.
• Read the JavaScript bundles - endpoints, feature flags and sometimes keys live there.
• Always check /robots.txt, /sitemap.xml, /.well-known/ and leftover source maps.