Hello, aspiring ethical hackers. In our previous blogpost, you learnt in detail about OSINT. In this article, you will learn about Recon-ng, a OSINT gathering tool.
Recon-ng is an open-source intelligence gathering tool aimed at reducing the time spent harvesting information from open sources. It is a full-featured reconnaissance framework designed to gather OSINT information very quickly.
Let’s see how this tool works. For this, we will be using Kali Linux as Recon-ng is installed by default on it. This tool can be started using command shown below.
recon-ng
If you notice the above images, the interface of Recon-ng is similar to Metasploit. It has been designed in such a way to decrease the learning curve. You can create different workspaces in Recon-ng. To create a new workspace, you have to use the command shown below.
workspaces create <name of workspace>
For example, we have created a new workspace named “hc_test”. The various framework items of Recon-ng that are useful to us can be seen using command shown below.
show
For this tutorial, let’s gather information about a domain. To do this, we need to first add a domain. This can be done using command shown below.
db insert domains
Now, you can see the domains you added using command shown below.
show domains
Similarly you can add and view other items too in similar manner. Just like Metasploit, Recon-ng has various modules each performing a specific function. You need to first add these modules to Recon-ng to be able to use them. This modules are found in ‘marketplace’ and can be viewed using command shown below.
marketplace search
This will list all available modules. Searching for the module we want can be laborious and in some cases nothing less than searching for needle in haystack. But don’t worry. You can even search for modules you want. For example, let’s search for Whois related modules. This can be done as shown below.
marketplace search <search term>
From here, you can install any module we want. This can be done using command shown below. For example, let’s install the recon/domain-contents/ whois-pocs/ module.
marketplace install <module>
Similarly, you can install other modules we want in the same way from the market place. Once they are installed, you can search for all installed modules using the command shown below.
modules search
To load a module, we use command as shown below.
modules load <module_name>
For example. let’s load the module we just installed.
Once the modules is loaded, you can view information about the module using the “info” command as shown below.
As you can read in the above module, this module retrieve poc data about a domain for Whois queries. Since we have already added a domain, all you have to do is execute the module using command “run”.
As you can see, the module retrieved contact information belonging to the domain we queried. This information contains first name, second name and email addresses of 46 contacts belonging to the domain (The retrieved data has been hidden for the purpose of privacy). This information can be useful while phishing or spear-phishing our targets.
In the same manner, we can retrieve other OSINT information using recon-ng. Next, learn how to perform OSINT using Maltego.
