In the two previous lessons we learned the theory of reconnaissance: what passive is (02-01), what active is (02-02), and where the boundary between them lies. Along the way we used tools in isolation -whois, dig, nmap -sn, nc, dnsx, wget- as they were needed. This lesson steps back to see them for what they are: an arsenal worth knowing, comparing, and above all orchestrating into a coherent flow.

Here we do not repeat the passive/active theory; we focus on the tools: what each one does, how to read its output, how the overlapping ones differ (Amass or Sublist3r? Shodan or Censys?), and how they fit into a recon pipeline for TechNova. The idea is for you to walk away knowing not only "which command to type", but which tool to choose for each goal and in what order to chain them.

1. A map of the recon arsenal
2. DNS and whois tools
3. All-in-one collectors (theHarvester, Recon-ng)
4. Subdomain enumeration (Amass, Sublist3r)
5. Device search engines (Shodan, Censys)
6. Visual relationship analysis (Maltego)
7. Metadata and web fingerprinting (FOCA/exiftool, Wappalyzer)
8. Orchestration: TechNova's recon flow
9. Common mistakes and tips
10. Exercises
11. Conclusion

There are dozens of tools and it is easy to get lost. The key is to group them by function, not memorize them one by one:

An important idea: many of these tools are aggregators. They do not "hack" anything; they query and combine the same public sources we saw in 02-01 (crt.sh, search engines, DNS), but in an automated way and at scale. They save you the manual work.

They are the foundation and you already know them; here we compare them so you pick the right one:

Quick-read examples:

Practical tip: dig is the professional standard thanks to its fine control (+short, +noall +answer, choosing a server with @). Reserve nslookup for Windows or when dig is not installed.

When you want to gather emails, subdomains, and hosts from multiple sources in one go, these frameworks automate the work.

theHarvester is fast and straightforward. It queries search engines, crt.sh, and other public sources:

Reading: in a single pass we obtain emails (which confirm the initial+lastname pattern deduced in 02-01) and hosts with their IPs. The -b flag chooses the sources (backends); -d, the domain.

Recon-ng is more powerful and modular: it works as a framework with "modules" (Metasploit-style) and a database where it accumulates results that enrich one another.

Comparison:

To discover subdomains exhaustively there are two references with different philosophies:

• Sublist3r: lightweight and purely passive. It queries search engines and public sources. Fast for a first sweep.
• Amass (OWASP project): far more complete. It combines passive sources with active resolution and optional brute forcing; it stores relationships and enables deep mapping.

Framing note: amass enum -passive stays passive; if you add active resolution/brute forcing, remember you are already in 02-02 territory and must respect the scope.

Shodan and Censys are search engines that continuously scan the Internet and index which services are exposed: banners, ports, certificates, technologies. The advantage for us is huge: we query their database (passive) instead of scanning ourselves, obtaining information as if we had scanned, but without touching the target.

Reading: Shodan has already seen this IP and tells us ports, versions, and even possible CVEs associated with those versions. It is a valuable shortcut, though the data may be somewhat out of date (which is why we will confirm in Module 3). You can also search by organization or by facets:

When information grows, it gets hard to see the connections: which email belongs to which person, which subdomain to which IP, which IP to which provider. Maltego solves this with a graphical canvas: you place an entity (a domain) and run "transforms" that discover and draw related entities.

Maltego does not discover anything the other tools cannot; its value is visualization and correlation, ideal for presenting the attack surface in an understandable way and for spotting non-obvious relationships among people, emails, and infrastructure.

Two specific tasks with specialized tools:

Document metadata. We already used exiftool in 02-01 on a single file. FOCA automates the full cycle: it searches for the domain's documents in search engines, downloads them, and extracts and aggregates their metadata (users, software, paths, printers), consolidating them.

Reading: aggregating several documents we see several users (jlopez, mgarcia) and a mix of software (Office and LibreOffice), which suggests a heterogeneous estate.

Web technologies. Wappalyzer identifies a site's stack (CMS, framework, libraries, server, analytics) from clues in the responses. It exists as a browser extension and as a CLI:

It confirms the PHP/MySQL stack in scope and adds detail (jQuery 1.12.4, an old version). It is light fingerprinting: useful for guiding the vulnerability study in Module 3.

What sets a professional apart is not knowing the tools, but chaining them with judgment. A typical flow for TechNova, from the most passive to the most active:

Logic of the order:

1. whois/dig fix the basics (domain, IPs, servers).
2. crt.sh + Sublist3r/Amass expand the subdomain list.
3. theHarvester/Recon-ng add emails and consolidate hosts.
4. Shodan/Censys contribute already-known exposure without us scanning.
5. FOCA/exiftool + Wappalyzer enrich with users and technologies.
6. Maltego ties everything into an understandable map.

Each tool feeds the next: Amass's subdomains are looked up in Shodan; theHarvester's emails are correlated in Maltego. That chaining is the "orchestration". All outputs go to a single inventory that in lesson 02-04 we will turn into a prioritized attack surface map.

• Using tools in isolation without a flow. Firing off commands at random scatters the information. Follow an order and dump everything into a single inventory.
• Choosing the wrong tool. Sublist3r for a quick glance; Amass when you need exhaustiveness. Using Amass in depth for something trivial wastes time (and adds noise).
• Trusting Shodan/Censys blindly. Their data can be out of date; they are a shortcut, not an absolute truth. Confirm in Module 3's scan.
• Crossing into active without meaning to. Amass and Recon-ng have active modules (brute forcing, resolution). If you enable those options, apply the rules of 02-02 and the scope.
• Forgetting API keys. Many of theHarvester/Recon-ng/Shodan's sources require an API key; without configuring them, you will get poor results and believe "there is nothing".
• Tip: document which tool and which source produced each piece of data. In the report, traceability ("subdomain X found via crt.sh, confirmed with dig") gives rigor and credibility.

Exercise 1. You have to choose a single tool for (a) a quick subdomain sweep in 30 seconds and (b) an exhaustive mapping that combines passive sources and active resolution. Which would you use in each case and why?

Exercise 2. Explain why querying shodan host 203.0.113.25 is considered passive reconnaissance even though it returns ports and versions of a server, something we would normally associate with an active scan.

Exercise 3. Arrange these tools into a logical recon flow for TechNova and justify the order: Maltego, whois, theHarvester, Amass. What does each step contribute to the next?

Solution 1. (a) Sublist3r: it is lightweight and purely passive, ideal for a quick glance at the subdomains without complex configuration. (b) Amass: it is the most exhaustive, combines multiple passive sources with active resolution/brute forcing and stores relationships, exactly what serious mapping demands. The rule: speed → Sublist3r; depth → Amass (remembering that its active modes enter 02-02 territory).

Solution 2. Because we are not the ones touching the server: Shodan scanned the Internet on its own some time ago and indexed the result in its database. When we run shodan host we query Shodan (a third party), not 203.0.113.25. The target receives no packet from us and logs nothing, which is the definition of passive. The "scan" was already done by someone else; we only read its result.

Solution 3. Logical order: 1) whois (fixes domain, owner, IPs, and name servers: the foundation). 2) Amass (from the domain, exhaustively enumerates the subdomains: expands the surface). 3) theHarvester (adds emails and consolidates hosts from multiple sources: contributes the "people/emails" vector). 4) Maltego (correlates and visualizes everything above: domains, subdomains, IPs, emails, and people in a single map). Each step enriches the next: the domain feeds the enumeration, and the subdomains and emails feed the final correlation.

We now know not only what reconnaissance is, but what to do it well with. We have toured the arsenal by families -DNS/whois, all-in-one collectors (theHarvester, Recon-ng), subdomain enumerators (Amass, Sublist3r), device search engines (Shodan, Censys), visual correlation (Maltego), and metadata/fingerprinting (FOCA, exiftool, Wappalyzer)-, we have learned to choose among the overlapping ones and, most importantly, to orchestrate them into a flow that goes from passive to active and dumps everything into a single inventory.

That inventory -subdomains, IPs, live hosts, versions, emails, users, technologies- is now a long but unprioritized list. A pile of data is not yet an attack surface. In the module's last lesson, 02-04 OSINT and Attack Surface Analysis, we will add the OSINT dimension (people, leaked credentials, cloud exposure, and code repositories, with its ethical and GDPR framework) and consolidate everything into a prioritized attack surface map: the deliverable that will tell Module 3 where to start scanning.