7.2 Recon and Enumeration Tools

Objective 2.4 is Given a scenario, use the appropriate tools for reconnaissance and enumeration. After 2.1 (what to collect), 2.2 (what to inventory), and 2.3 (how to glue it with a script), PT0-003 becomes a matching exam: which named tool does this job. You do not need every flag. You need the job-to-tool mapping, plus three traps that recycle every sitting: Shodan versus Nmap, Maltego versus theHarvester, and dig versus Nmap.

Work example.com the same way as earlier Domain 2 chapters. Confirm RoE selectors first. Then pick the tool that matches the data type the stem wants — historical pages, DNS, people, wireless identifiers, packets, third-party internet indexes, or live ports on in-scope hosts. A 2.3 Bash loop that calls dig is still a dig question if the stem asks which tool answered the MX record. A Python requests wrapper around a Shodan API is still Shodan if the stem asks where the banner came from.

OSINT graphs and the framework index

Maltego is the graph. Transforms turn a domain, email, or IP into linked entities you can see: name servers, people, netblocks, documents. Use it when the stem asks you to visualize relationships, not when it only asks you to dump a list of mailboxes.

SpiderFoot automates OSINT modules against a target and aggregates the results into one report. Recon-ng is a modular, Metasploit-like CLI workspace: set a domain, run recon modules, store results in a workspace database. Both are "run many OSINT sources from one console." They are not packet captures, and they are not Nmap.

OSINTframework.com is not a scanner. It is a directory of OSINT resources you browse to choose the next source (search engines, leaked-data sites, geospatial tools, and so on). If the item says "which site lists OSINT tools by category," that is OSINTframework.com, not Shodan and not Nmap.

Exam trap: Maltego graphs; theHarvester lists. If the stem wants harvested emails, do not pick Maltego just because both are "OSINT." If the stem wants a relationship picture for example.com, do not pick theHarvester just because it can also see names.

Internet-wide indexes versus you scanning

Shodan and Censys.io search third-party internet-wide scan data: banners, certificates, and services already observed by someone else's scanners. Querying them is passive from your side — no SYN packet to the client's host. Use them to learn what the internet already knows about example.com: an exposed admin panel on a forgotten host, a certificate SAN list, an outdated banner.

Nmap, including NSE (the Nmap Scripting Engine), is you scanning in-scope hosts. NSE scripts add version checks, default-script (-sC) enumeration, and protocol helpers (SMB, HTTP, DNS, and others listed in the script help). If the RoE window is open and the stem needs current open ports on the agreed CIDR, the answer is Nmap, not Shodan. NSE is still Nmap. Do not pick Recon-ng because the word "script" appeared.

Exam trap: Shodan is not your in-scope scan

Shodan is third-party internet data. Nmap is your scan of in-scope hosts. A stale Shodan banner is not proof tcp/22 is still open today. Nmap against addresses that are not in the SoW is an authorization failure even if Shodan already listed them. Censys.io is in the same family as Shodan: an index you query, not a substitute for the in-window scan. If the stem says "do not send packets to the target" and still wants service banners, pick Shodan or Censys. If the stem says "confirm live ports during the testing window," pick Nmap.

DNS, registration, and name discovery

WHOIS returns registrar, registrant (where not redacted), name servers, creation dates, and netblock contact data. It is a registration lookup, not a port scan. It does not list every subdomain Amass would find.

nslookup and dig are local DNS query tools: A, AAAA, MX, NS, TXT, PTR. dig is the Linux-favored, scriptable choice (easy to drop into a Bash loop from 2.3). nslookup still appears on Windows. Neither tool SYN-scans ports. A dig example.com MX answer names a mail host; it does not prove tcp/25 is open.

DNSdumpster is a web OSINT view of a domain's DNS footprint — records, related hosts, and a map. Amass performs attack-surface mapping and subdomain discovery across many sources. Used passively, it stays in 2.1-style OSINT; if you enable active collection, you are touching target infrastructure and need RoE. Use Amass when the stem wants a large subdomain inventory, not a single A record. Use dig when the stem wants one record type from a resolver you control.

Exam trap: dig answers a DNS question. Nmap answers a port and service question. Do not pick Nmap to "see the MX record." Do not pick dig to "confirm which TCP ports are open on the mail host." WHOIS is not Amass: registration metadata versus name inventory.

People, email, and historical pages

Hunter.io finds email addresses and patterns for a domain (often first.last@example.com) and is the usual pick when the stem is specifically email-pattern OSINT for pretext recon (still recon, not the Domain 4.8 send). theHarvester collects emails, names, subdomains, and hosts from search engines and other public sources in one pass. Pick theHarvester when the stem wants a broad harvest from multiple public sources, not a relationship graph. Pick Hunter.io when the stem is the mailbox pattern itself.

Wayback Machine (Internet Archive) retrieves historical snapshots of pages: old JavaScript endpoints, retired subdomains, forgotten admin paths, last year's privacy policy that still listed an internal hostname. It is passive. It is not a live crawler of today's application — live crawling was 2.2. It is not Nmap -sV against the current virtual host.

Wireless recon: identify, do not attack

WiGLE.net is a wardriving database: historical SSID, BSSID, and GPS observations other people uploaded. InSSIDer is a local Wi-Fi discovery GUI: which SSIDs, BSSIDs, channels, and strengths you see from the parking lot or the authorized floor.

Aircrack-ng appears on the official 2.4 list as a recon tool: capture and identify wireless networks (monitor mode, airodump-ng-style inventory of SSIDs and clients). Full wireless attacks — deauthentication, evil twin, cracking a handshake as an attack — live in Domain 4.7. If the stem only asks you to identify nearby BSSIDs before the attack phase, stay with WiGLE.net, InSSIDer, or Aircrack-ng in capture-and-identify mode. Do not pick WHOIS to "resolve an SSID," and do not pick Shodan as the campus Wi-Fi sniffer.

Packets on the wire

Wireshark is the GUI packet analyzer. tcpdump is the CLI capture tool on Linux (easy to call from a Bash recon script). Use them to inspect DNS queries, HTTP Host headers, TLS handshakes, and mis-aimed broadcasts on a segment you are authorized to join. They are not subdomain enumerators, not email harvesters, and not internet-wide indexes. If the stem is "see which names the workstation is resolving right now," pick Wireshark or tcpdump, not Amass. If the stem is "build a subdomain wordlist from public sources," pick Amass or theHarvester, not tcpdump.

Worked walkthrough: example.com tool order

Client names example.com. Passive first: WHOIS for registrar and NS, dig/nslookup for MX and TXT, DNSdumpster or Amass for a name inventory, Wayback Machine for old admin paths, Shodan or Censys.io for what the internet already observed, Hunter.io or theHarvester for people, Maltego (or SpiderFoot / Recon-ng) if leadership wants a graph, OSINTframework.com if you forgot which OSINT source exists. After written RoE: Nmap with NSE on the agreed CIDR, Wireshark or tcpdump on the authorized span, InSSIDer, WiGLE.net, or Aircrack-ng identify for campus SSIDs. If you Nmap first because Shodan existed, you skipped 2.1 sequencing. If you treat Shodan as the in-window port list, you fail the 2.4 trap. If you pick theHarvester when the screenshot is a Maltego graph, you fail the people-versus-graph trap. If you pick Nmap when the question is an MX record, you fail the dig-versus-Nmap trap.

Tool-to-job table

Matching traps to memorize

Memorize the job, then the name. PT0-003 will not grade you in 2.4 on writing a new NSE script from scratch. It will ask whether the next click is Wayback, Maltego, Shodan, dig, Nmap, or a wireless identifier — and whether that click stays inside RoE.