Episode
Course 35 - Footprinting and Reconnaissance | Episode 7: Information Gathering and Domain Reconnaissance Lab
- Podcast
- CyberCode Academy
- Published
- May 28, 2026
- Duration seconds
- 1123
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-35-footprinting-and-reconnaissance-episode-7-information-gathering-and-domain-reconnaissance-lab/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cybercode-academy-7578615/course-35-footprinting-and-reconnaissance-episode-7-information-gathering-and-domain-reconnaissance-lab.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
In this lesson, you’ll learn about: reconnaissance using Recon-ng1. What is Recon-ng? A full-featured web reconnaissance framework Pre-installed on Kali Linux Designed to automate OSINT and domain reconnaissance 🔹 Core Concept Works like a framework (similar to Metasploit) Uses modules to perform different recon tasks 👉 Purpose: Build a structured database of target intelligence 2. Tool Overview Recon-ng 🔹 Key Capabilities Domain intelligence gathering Contact harvesting Subdomain discovery File and directory enumeration 👉 Advantage: Organizes results into a workspace database 3. Workspace & Domain Setup🔹 Initial Steps Create a workspace Add target domain 👉 Why it matters: Keeps recon data organized and reusable 4. Contact Harvesting🔹 Module: whois_pocs Extracts: Names Email addresses Locations 👉 Use Case: Build a target profile Useful for: Social engineering OSINT correlation 5. Host Discovery & Stealth🔹 Module: bing_domain_web Finds: Hosts Indexed subdomains 🔹 Stealth Feature Recon-ng introduces delays (sleep) between requests 👉 Benefit: Mimics human browsing Reduces detection risk Avoids IP blocking 6. Subdomain Brute-Forcing🔹 Module: brute_hosts Uses wordlists to guess subdomains 🔹 Output Hidden subdomains Associated IP addresses 👉 Importance: Expands the attack surface Reveals hidden infrastructure 7. Sensitive File Discovery🔹 Module: interesting_files Searches for: robots.txt Backup files Config files 👉 Why it matters: May expose: Hidden directories Internal paths Misconfigurations 8. Analyzing Server Responses🔹 HTTP Status Codes 404 → Resource not found (client-side issue) 300-series → Redirection 👉 Insight: Helps understand: Server behavior Application structure 9. Cybersecurity Use Case🔹 Reconnaissance Phase Early stage of: Penetration testing Bug boun…