---
description: Offensive recon — subdomain, DNS history, leak search, fingerprint, OSINT
---
// turbo-all

> CONTEXT: Workflow ini dipake buat full offensive recon terhadap target. Pakai SecurityTrails API buat domain/subdomain intel, kombinasi sama web search buat CVE/exploit terbaru.

# /recon — D1337 Offensive Recon

## Prerequisites

- SecurityTrails API key (set di env: `SECTRAILS_KEY`)
- Target domain/IP dari Ketua/Abangda

---

## Phase 1: Domain Intel (SecurityTrails)

```bash
# 1. Domain overview
curl -s "https://api.securitytrails.com/v1/domain/$TARGET" \
  -H "apikey: $SECTRAILS_KEY" | python -m json.tool

# 2. Subdomain enumeration
curl -s "https://api.securitytrails.com/v1/domain/$TARGET/subdomains" \
  -H "apikey: $SECTRAILS_KEY" | python -m json.tool

# 3. DNS history (A records)
curl -s "https://api.securitytrails.com/v1/history/$TARGET/dns/a" \
  -H "apikey: $SECTRAILS_KEY" | python -m json.tool

# 4. WHOIS history
curl -s "https://api.securitytrails.com/v1/history/$TARGET/whois" \
  -H "apikey: $SECTRAILS_KEY" | python -m json.tool

# 5. Associated domains (reverse IP)
curl -s "https://api.securitytrails.com/v1/domain/$TARGET/associated" \
  -H "apikey: $SECTRAILS_KEY" | python -m json.tool
```

## Phase 2: Tech Fingerprint

```bash
# Pakai search_web atau firecrawl_search
# Target: "$TARGET site:shodan.io OR site:censys.io"

# Cek tech stack
curl -s "https://$TARGET" -I | grep -i "server\|x-powered-by\|x-aspnet\|x-generator"

# Pakai httpx kalau ada
# httpx -u https://$TARGET -tech-detect -status-code
```

## Phase 3: CVE & Exploit Hunting (WAJIB)

```bash
# search_web: "$TARGET_TECH CVE 2024 2025 exploit PoC"
# search_web: "$TARGET_TECH vulnerability RCE"

# Cek exploit-db
# firecrawl_search: "site:exploit-db.com $TARGET_TECH"

# Cek GitHub PoCs
# firecrawl_search: "site:github.com $TARGET_TECH exploit PoC"
```

**Output yang dibutuhin:**
- CVE number
- Affected versions
- PoC link (GitHub/exploit-db)
- Attack vector description

## Phase 4: Subdomain Takeover Check

```bash
# Dari subdomain list Phase 1
# Cek CNAME records yang dangling
# dig CNAME sub.$TARGET
# Kalau NXDOMAIN + CNAME ke service (AWS, Azure, Heroku) → takeover possible
```

## Phase 5: Report

Output format:

```markdown
# Recon Report: $TARGET

## Domain Intel
- Subdomains found: X
- DNS history changes: Y
- Associated domains: Z

## Tech Stack
- Server: X
- Framework: Y
- CMS: Z

## Vulnerabilities Found
| CVE | Severity | PoC | Status |
|-----|----------|-----|--------|
| CVE-XXXX-XXXXX | Critical | [link] | Unpatched |

## Subdomain Takeover
| Subdomain | CNAME | Status |
|-----------|-------|--------|

## Recommended Attack Vectors
1. ...
2. ...
3. ...
```

---

> **Recon itu fondasi. Tanpa recon yang solid, exploit lu bakal sia-sia. SCAN HABIS, DOCUMENT SEMUA.**