Instructor: In this lesson, 2 2
I'm going to show you how to use Recon-ng. 3 3
For the exam, 4 4
you do not need to know how to actually use these tools 5 5
and all of their command line options. 6 6
But you should know why you would use each tool, 7 7
and in the basic case of OSINT, 8 8
and then more specifically, 9 9
what type of OSINT information 10 10
you could get from these tools. 11 11
It's important to remember that open source intelligence 12 12
is not trying to connect to our targeted servers. 13 13
Instead, we're trying to find out information about them 14 14
by connecting to other servers on the internet 15 15
or by searching elsewhere on the internet. 16 16
Recon-ng has a lot of great capabilities, 17 17
because it uses a system of modules 18 18
to add additional features and functions for your use. 19 19
For example, there's a module to conduct whois queries 20 20
to identify administrative and technical points of contacts. 21 21
There's another one to conduct PGP key searches 22 22
and another for social media profile searching, 23 23
yet another for file crawling of websites, 24 24
and yet another one for DNS record searching 25 25
and enumeration. 26 26
If you have a list of emails 27 27
for your reconnaissance efforts, 28 28
you can also use Recon-ng 29 29
to check if those emails have been the victim 30 30
of a data breach previously by checking, have I been pawned? 31 31
And if so, 32 32
you might be able to find those passwords available 33 33
as part of a password dump for sale over on the dark web. 34 34
Now, Recon-ng is a Python script, 35 35
and it makes it cross-platform and supported by Linux, 36 36
MacOS and Windows. 37 37
This web reconnaissance framework does come pre-installed 38 38
in Kali Linux by default. 39 39
The next thing we're going to go ahead and do 40 40
is work with Recon-ng. 41 41
So to start up Recon-ng, 42 42
you just type in recon-ng and hit Enter. 43 43
When you do that, it's going to load up. 44 44
And now you're in a special command prompt 45 45
within the Recon-ng environment. 46 46
Notice here, we're in Recon-ng, 47 47
and we are in the default workspace. 48 48
Now, Recon-ng is a wonderful web reconnaissance framework. 49 49
And it works a lot like Metasploit does for exploits 50 50
and the Social-Engineer Toolkit 51 51
works for social engineering. 52 52
It brings a lot of tools and a lot of capabilities 53 53
into one place. 54 54
But because of that, it is a little bit more complicated. 55 55
Now also, the other thing to note 56 56
is a lot of the things you're going to find online for Recon-ng 57 57
are going to be wrong, 58 58
and they're not going to work. 59 59
The reason for that is there was a switch 60 60
in a lot of the syntax 61 61
going between version 4 and version 5. 62 62
You can see here I'm operating with version 5.1.2, 63 63
which is the latest at the time of this recording. 64 64
So all the things I'm going to show you now 65 65
are based on that version. 66 66
These will not work in the older version 4. 67 67
And the old version 4 commands 68 68
will not always work in the newer version 5. 69 69
So keep that in mind 70 70
if you're looking at any tutorials online or YouTube videos. 71 71
If they're older than about 2020, 72 72
you may run into some issues there. 73 73
Now to use this, 74 74
we're going to launch into Recon-ng just like we did here. 75 75
And now I like to personally set up my own workspace 76 76
instead of using the default workspace. 77 77
This gives me almost a place to store 78 78
and save all my different commands 79 79
and tools and information that I find in one area. 80 80
And so to do this, we are going to use the workspaces command. 81 81
Now, if you don't know any of the commands in Recon-ng yet, 82 82
which you probably don't, 83 83
you might want to first type in help. 84 84
When you type in help, 85 85
it'll list out all the commands you can use. 86 86
And you'll see there that we have one called workspaces 87 87
at the bottom of the list. 88 88
And this is used to manage workspaces. 89 89
A workspace is just a defined area 90 90
to keep your different information 91 91
from different engagements into different buckets, 92 92
so they're not mixing between clients. 93 93
So what I'm going to do is I'm just going to type in the word, 94 94
workspaces. 95 95
And then from workspaces, if I hit Enter, 96 96
it's going to tell me I didn't give enough syntax, 97 97
because we didn't know what to do with it yet. 98 98
Here we can do a create, list, load or remove. 99 99
In our case, we can see 100 100
if there's any workspaces already. 101 101
And there shouldn't be, 102 102
because this is a brand new installation. 103 103
But by doing that we do workspaces, 104 104
Space, list and hit Enter. 105 105
And you see we only have the default one. 106 106
I'm going to go ahead and create one called Dion. 107 107
And to do that, we're just going to type in workspaces create. 108 108
And then I'm going to use the folder name of Dion. 109 109
Now if I go ahead and do workspaces list, 110 110
you're going to see two, default and Dion. 111 111
All right, now that we've done that, 112 112
we can go ahead and select that workspace to work in it. 113 113
And in this case, because I just created that workspace, 114 114
it automatically put me into the Dion workspace. 115 115
But let's say I had another one, 116 116
because I was going to do workspaces create Udemy. 117 117
Now I'm going to have three different workspaces. 118 118
Oh, I actually typed that wrong, 119 119
so make sure you type it correctly. 120 120
Everything in Linux is case sensitive 121 121
and obviously spelling sensitive. 122 122
I forgot the S on workspace, 123 123
and that's why I got that error. 124 124
So here we go. I listed it out. 125 125
And you see there are three workspaces now, 126 126
Dion, Udemy and default. 127 127
When you create a new workspace, 128 128
by default, it moves you into that workspace. 129 129
So you'll notice when I created Dion 130 130
right next to recon-ng, 131 131
there was this thing that said bracket Dion bracket. 132 132
And that told me that I was in the Dion space. 133 133
And you can see that just below the first table 134 134
where I entered workspaces create Dion, 135 135
it moved me into that Dion workspace. 136 136
Then when I created the Udemy workspace, 137 137
it then changed me from Dion into Udemy. 138 138
But let's say I wanted to go back into Dion, 139 139
how would I do that? 140 140
Well, to do that, we're just going to type in workspaces load 141 141
and then the name of the workspace. 142 142
In my case, it's Dion. 143 143
Now you can see I am back into Recon-ng 144 144
inside the workspace Dion. 145 145
All right, the next thing we have to do 146 146
is we have to have some modules installed 147 147
to be able to do some functionality inside of Recon-ng. 148 148
Now by default, there is no modules installed 149 149
when you first get Recon-ng. 150 150
And this is a brand new install. 151 151
And if you just loaded up your virtual machine, 152 152
you have a brand new install as well. 153 153
And so these are things we have to work through. 154 154
So what we're going to do 155 155
is we're actually going to go into the module section, 156 156
which is another one of those keywords. 157 157
Again, if you get lost at any time, 158 158
just type in help. 159 159
And you'll notice there we have a modules command, 160 160
and it says that it interfaces with installed modules. 161 161
So to check if there's any installed modules, 162 162
I'm just going to type in modules. 163 163
And then I would use the command search. 164 164
Now if you don't know any of the commands for modules, 165 165
again, just type in modules and hit Enter. 166 166
There is your different options. 167 167
You can load, reload or search. 168 168
Search is essentially like listing. 169 169
But you can list all of them 170 170
if you just type in search and hit Enter. 171 171
Or you can actually search for a keyword, 172 172
because there are many modules, 173 173
and maybe you just want a specific module 174 174
for a specific use case. 175 175
If I go ahead and hit search and hit Enter, 176 176
you're going to see that I have no modules found, 177 177
and it has a red arrow there. 178 178
That's because I haven't installed anything yet. 179 179
And so now we need to go and find some modules. 180 180
How do you do that? 181 181
Well, looking back up at the help area, 182 182
you'll see a command called marketplace. 183 183
This interfaces with the module marketplace. 184 184
And this is where you can search for 185 185
and download a single module or all the modules. 186 186
Now, some modules you're going to find 187 187
are going to require you to get an API key 188 188
to be able to associate with the service. 189 189
For example, there's a module to be able to search Twitter. 190 190
And Twitter requires you to register with them 191 191
as a developer to get an API key, 192 192
so you can then make that API connection 193 193
from Recon-ng into Twitter and start searching their stuff. 194 194
Now, to make things easy for our demonstration, 195 195
we're not going to go into that. 196 196
And I'm going to pick a module that does not require API keys. 197 197
If you're going to use Recon-ng for real, 198 198
go online, look at the Recon-ng manual. 199 199
You'll be able to walk through 200 200
how to do all of those things, 201 201
because there's a lot of capability in this tool. 202 202
For the exam, you do not need to know how to use Recon-ng. 203 203
I just wanted to show you, 204 204
so you can get comfortable with it, 205 205
so you can use it in the real world a little bit 206 206
and then take it from there. 207 207
Now, what we want to do first 208 208
is we want to find a module that we can use. 209 209
The one I'm going to use is known as recon 210 210
slash domain contacts slash whois pocs. 211 211
I know this one doesn't require an API. 212 212
And the purpose of this is for us to be able to use this 213 213
to look up the whois data for different domain names. 214 214
Now, to do this, 215 215
we're just going to use the command marketplace. 216 216
And then we're going to use the term install. 217 217
Now, just like before, 218 218
if you don't know how to do something, 219 219
you can simply type in marketplace and Enter, 220 220
and it will give you the syntax. 221 221
And then you're going to put the one that you're looking for. 222 222
In my case, I know exactly which one I'm looking for. 223 223
It's recon slash domains dash contacts 224 224
slash whois underscore pocs. 225 225
Hit Enter. 226 226
And it's going to go ahead and install that module. 227 227
You'll see right here, it installed the module, 228 228
and then it reloaded it. 229 229
If I want to validate that actually happened, 230 230
I can do that by using the module search command 231 231
like I did before to show there was no modules found. 232 232
So let's go ahead and do that. 233 233
And now instead of no modules being found, 234 234
I see that I have one module found. 235 235
It's under the recon category. 236 236
And it is the one I just installed. 237 237
Now, if you want to to install all of the modules, 238 238
and there are a lot of them out there, 239 239
if you want to see them all, 240 240
just type in marketplace and then hit search 241 241
and then hit Enter. 242 242
And you'll see there is a bunch. 243 243
There are so many 244 244
that it is actually going off of my screen. 245 245
And so if you wanted to actually scroll up here, 246 246
you can go through 247 247
and see that there are a ton of different modules. 248 248
And all of these have different functionality. 249 249
If you want to know what each one does, 250 250
you can actually look them up inside of Recon-ng 251 251
using the info command. 252 252
And you'll be able to learn more 253 253
about those particular tools. 254 254
Or again, go online, go ahead and Google 255 255
or Bing or DuckDuckGo 256 256
or whatever your favorite search engine or choice is 257 257
and look up those. 258 258
And you'll figure out which ones they are, what they do, 259 259
and which ones may be helpful in your reconnaissance. 260 260
Now, if you want to to install all of these, 261 261
you certainly can. 262 262
And to do that you just type in marketplace 263 263
install all. 264 264
And if I hit Enter right now, 265 265
it's going to go and install every single one of those. 266 266
Now, the reason I'm not going to do that 267 267
is because it's going to clutter up our screen. 268 268
It's going to throw a bunch of errors, 269 269
because we haven't set up all the API keys 270 270
for all 40 or 50 different Recon modules. 271 271
And so I'm going to not do that right now. 272 272
But if you want to do that, 273 273
and you want to set up your system fully, 274 274
you can install all and then go find API keys 275 275
for every single one of those modules. 276 276
Now the next thing we need to do 277 277
is actually take that module and load it. 278 278
Now again, if I type in modules search, 279 279
you're going to see that I have installed that module. 280 280
But it doesn't mean it's loaded and ready for me to go, 281 281
because you can see where I am 282 282
inside of the Recon structure. 283 283
I'm at recon-ng, Dion. 284 284
I'm not inside a module. 285 285
I'm not inside any of the options. 286 286
I'm just inside the workspace. 287 287
So again, we're just going to type in modules and hit Enter. 288 288
You're going to see the syntax. 289 289
We have load, reload and search. 290 290
I'm going to go ahead and type in modules load. 291 291
And then I want to use the whois underscore pocs, 292 292
which is the short name for the module I loaded. 293 293
There we go. Notice how my prompt change. 294 294
Now I'm inside this module. 295 295
Now that we're in the module, 296 296
we need to specify the options 297 297
that we want to use with the module. 298 298
And we're going to do that 299 299
by entering information into our database. 300 300
Now, inside of Recon-ng, 301 301
there's actually a database installed with it. 302 302
And you're able to put information into the database, 303 303
both things you want to search for 304 304
and information that's going to come back 305 305
when you do those searches. 306 306
Now, to do this and work with the database, 307 307
we need to use the db command. 308 308
And again, if you get lost at any time, 309 309
just type in help. 310 310
You'll notice there, the third line down is db, 311 311
which interfaces with the workspaces database. 312 312
Each workspace has its own database. 313 313
And that's another reason you want to have a workspace 314 314
dedicated to whatever engagement you're working on. 315 315
So we're going to go ahead and use db. 316 316
And then again, we can hit Enter. 317 317
And it'll tell us what things we can do with the database. 318 318
We can delete a database. 319 319
We can insert a line in a database. 320 320
We can add notes to a database. 321 321
We can query it using SQL commands. 322 322
Or we can look at the database schema. 323 323
Now, if I wanted to see the schema of the database, 324 324
I can just type in db schema and hit Enter. 325 325
And when I do that, 326 326
again, it scrolls off the screen a little bit. 327 327
But as we scroll up, 328 328
you can see the different tables that we're using. 329 329
I'll get up here to the top. 330 330
There we go. 331 331
So the first one we have is domains. 332 332
And this will hold domains, notes 333 333
and the module that found the information. 334 334
Under companies, it has company description, 335 335
notes and module. 336 336
And you're going to see each of these are going to interact 337 337
with different parts of Recon-ng and different modules. 338 338
Domains is the one 339 339
we're actually going to be working with here, 340 340
because I'm using the whois point of contacts module. 341 341
So let me go ahead and get back here to the bottom. 342 342
I'm just going to hit Enter. It'll drop me right down. 343 343
Okay, and now what we want to do 344 344
is go back to our database command. 345 345
And what we want to do is insert information 346 346
into that database, 347 347
specifically the domain names that we want to look at. 348 348
Now what I'm going to do is I'm just going to type in db, 349 349
insert and then domains, 350 350
which is the field that I want to insert information in. 351 351
And at that point, I hit Enter. 352 352
And it's going to say, 353 353
what do you want to enter in here? 354 354
Well, the thing I want to enter is the domain name, 355 355
so if I wanted to search diontraining.com, 356 356
I can enter that in. 357 357
If there's any notes I want to put in, 358 358
I could put them in here and true. 359 359
I'm just going to hit Enter and make that blank. 360 360
And it's going to insert that into one row. 361 361
Now if I want to enter another domain to search, 362 362
I can do that here as well. 363 363
Let's go ahead and do insert domains. 364 364
And in this case, I'm going to use udemy.com. 365 365
Another one I want to enter, 366 366
let's go ahead and do db insert. 367 367
And we'll do domains, 368 368
and I'm going to use tesla.com. 369 369
And again, no notes. 370 370
All right, 371 371
we have now inserted three different domain names, 372 372
diontraining.com, udemy.com and tesla.com, 373 373
into our database. 374 374
Now if we want to see that and verify it took, 375 375
we can use the command show and then the name of the table, 376 376
in this case, domains. 377 377
So show domains. 378 378
And here is our table. 379 379
Boom, we have three rows, 380 380
diontraining.com, udemy.com, tesla.com. 381 381
No notes on any of them. 382 382
And the module was user-defined, 383 383
because I manually enter that information. 384 384
All right, now that we have loaded our module, 385 385
now that we have entered our information into the database, 386 386
we are ready to start searching the whois database 387 387
for these points of contact. 388 388
Now, what we're going to do 389 389
is we are going to use this whois poc module. 390 390
If you don't know what that module is, 391 391
well, we're inside of it now, 392 392
so we can just type in the command info. 393 393
By typing info, 394 394
it's going to tell me about the module I'm currently in. 395 395
Notice when I typed info for whois pocs, 396 396
it tells me this is the Whois POC Harvester, 397 397
who wrote it, the version and a short description of it. 398 398
It's going to use the ARIN whois database 399 399
to able to harvest POC data from the whois queries 400 400
for the given domain. 401 401
This is also going to update our contacts table 402 402
with the results inside of our workspace. 403 403
So that data we get back 404 404
is going to fill part of our database in the workspace, 405 405
so we can go back and look at that information later. 406 406
Now we have some options that we have to have. 407 407
We have a source. 408 408
We have the value of default. 409 409
It's required field, 410 410
and the description is the source of input. 411 411
Now, by default, 412 412
that means it's going to go and grab it from the table. 413 413
Those three domain names we just put in 414 414
in rows one, two, and three using the domains table. 415 415
If I wanted to do this from a file, 416 416
I could do that as well by changing this default value 417 417
from default to the file name. 418 418
In our case, we're going to do it right from the database. 419 419
It keeps it nice. It keeps it clean. 420 420
And that's the way we're going to do it. 421 421
Now, if I wanted to change that, 422 422
I could do that by changing that by saying options set, 423 423
because I'm changing the options. 424 424
In this case, I want to set the value of that 425 425
from default to something else. 426 426
Now in our case, I don't want to do that, 427 427
so I'm going to go ahead and delete that. 428 428
But you could do that 429 429
if you wanted to go ahead and read it from a file, 430 430
read it from an SQL query or something else. 431 431
As you can see here, the default is 432 432
to select distinct domain from domains 433 433
where domain is not null, 434 434
which just basically means go into the database, 435 435
look for the domains table. 436 436
And any domain inside of the domains table, 437 437
I want to grab each one that's not blank, 438 438
and we're going to test it. 439 439
So this is going to allow me to test all three of them 440 440
with one command. 441 441
Now that we know that our options are good, 442 442
to run this command, 443 443
we are just going to simply type run and hit Enter. 444 444
When we do that, it's going to go off, 445 445
and it is pulling that information, 446 446
and it's grabbing all that information, 447 447
and it dumps it to the screen. 448 448
Now, that's helpful. 449 449
But the screen makes it pretty hard to read, 450 450
because I'd have to scroll up and look at that, 451 451
because we just found 16 new records, 452 452
and 12 of those were new contacts 453 453
that were either not duplicated 454 454
or were new things that we wanted to add. 455 455
Those all got put into our database. 456 456
Now, if you remember back, 457 457
I said we can show things from the database 458 458
using the show command. 459 459
Before, we use show with domains to show the three domains. 460 460
Now I want to go ahead and use show with contacts 461 461
to see the contacts table. 462 462
Here it is. 463 463
So we have those 12 entries 464 464
going from row one all the way down to row 12. 465 465
Now my screen is a little bit zoomed in 466 466
to make it easier for you to read in the video. 467 467
If I was zoomed out, 468 468
it would all fit in one nice table. 469 469
Here you could see that three columns, 470 470
the phone, notes and module row, 471 471
went to the second line. 472 472
Now let's go ahead and read the first line. 473 473
The first line we have is based on Udemy. 474 474
You could see here that we found no first name, 475 475
no middle name. 476 476
The last name was Operations Architect. 477 477
The email was netops+ARIN@udemy.com. 478 478
The title was Whois contact, 479 479
because that's the type of information we got. 480 480
The region, San Francisco, California. 481 481
The country, United States. 482 482
And then phone, blank. Notes, blank. 483 483
Module, whois pocs, 484 484
which is the module we use to find this information. 485 485
Now there's lots of modules in Recon-ng. 486 486
You might be finding contacts by doing Twitter searches, 487 487
LinkedIn searches, Google searches, whatever it is, 488 488
All that will go into this database 489 489
to create our table of people. 490 490
But this tells us which module found that information 491 491
and which type of information it was. 492 492
In this case, a whois contact. 493 493
Next, we have lines two through 12. 494 494
And these are all based on Tesla. 495 495
Now you'll notice Dion training didn't show up. 496 496
The reason for that is we actually have our whois records 497 497
set up with privacy, 498 498
and so those are not going to be shared in the whois database. 499 499
It just says this is a private record. 500 500
So there was no way to grab that information 501 501
and add it to the table. 502 502
That's why we have the one for Udemy, 503 503
which is a very common way 504 504
of doing it for a large organization. 505 505
They actually have a group email, 506 506
not a person's email. 507 507
But if we look at Tesla, 508 508
they chose not to do that. 509 509
Tesla actually has individual people's names. 510 510
Now as I look at them, 511 511
what is this information that's going to be useful? 512 512
Well, for one, I have names of people and emails I can use. 513 513
That's the obvious one. 514 514
But in addition to that, 515 515
I might be able to figure out what naming scheme 516 516
that company uses. 517 517
For example, maybe you can't find everybody's email 518 518
when you're doing your open source research. 519 519
But you found their first and last name on LinkedIn. 520 520
Well, if you know that the company uses 521 521
first name dot last name, like elon.musk@tesla.com, 522 522
then you could put that in 523 523
for everybody you find on LinkedIn, 524 524
and now you have their email. 525 525
Conversely though, we actually don't see that here. 526 526
With Tesla, I am seeing multiple different naming schemes. 527 527
The first one, Anna, actually shows up as Ann, 528 528
which is three letters from her first name 529 529
and then her full last name, martinez@tesla.com. 530 530
The next one is just an abbreviation for the name Cameron. 531 531
And they called it cam@tesla.com. 532 532
The next one is Cheri, 533 533
but it's abbreviated down to C-H-E, 534 534
the first three letters again, 535 535
and then her last name, lewis@tesla.com. 536 536
We get down to Elon Musk, 537 537
it's first name dot last name. 538 538
We get down to Jian Gu, 539 539
we're seeing his full name slap together with no period, 540 540
so it's another different convention. 541 541
We go down to line nine, 542 542
and we see mahdesai. 543 543
And this is the first three letters 544 544
and the last name@tesla.com. 545 545
We get down to Paul Smicker, 546 546
and we just see paul@tesla.com. 547 547
We get down to Terry Chi, 548 548
and we see tchi@tesla.com. 549 549
So we're seeing a little bit of differentiation here. 550 550
But several of them, I saw at least three, 551 551
that had the first three letters and then the last name. 552 552
So I'm thinking that might be the naming convention 553 553
at Tesla for their employees. 554 554
Now, if I wanted to validate that, 555 555
I could take some people's names who I find on LinkedIn, 556 556
and I know their first name and last name, 557 557
put them into that format 558 558
of the first three letters and their last name@tesla.com 559 559
and then see is it a valid email 560 560
by checking something like email dossier at CentralOps 561 561
or other things like that. 562 562
So hopefully, you can start seeing 563 563
how we put all these different tools together 564 564
and get information from different places, consolidate it, 565 565
and then we can start doing things with it, 566 566
like spearfishing campaigns or railing campaigns 567 567
or social engineering in general. 568 568
Lots of different ways to start using this information. 569 569
Now, as I said at the beginning, 570 570
there are a lot of different modules to Recon-ng. 571 571
And I just wanted to show you the basic usage, 572 572
because all the modules work the same way. 573 573
As you go into a workspace and then as you go into a module, 574 574
you're going to keep going through the directory structure 575 575
like you saw here, recon-ng, Dion, whois pocs. 576 576
Now, if I wanted to go back, 577 577
I could just type in the word back, 578 578
and it'll bring me up a level as well. 579 579
And then I can go ahead and load a different workspace. 580 580
And then I can go ahead and do another assessment. 581 581
Now remember, you can always use the show command 582 582
to show anything you want. 583 583
Just like I did show domains or show contacts, 584 584
you can also show companies. 585 585
You can show credentials. 586 586
You can show hosts, leaks, locations, net blocks, 587 587
ports, profile, pushpins, repositories and vulnerabilities, 588 588
because all of those have tables in the database 589 589
as you saw when we look at the database schema. 590 590
Now, all of those get things from various modules 591 591
that you may or may not install. 592 592
So that's the important thing is to have the right module 593 593
for the right thing you're trying to grab. 594 594
In this demonstration, I only used one module, 595 595
and I only searched for contacts, 596 596
so that's why we saw things in the show contacts 597 597
to display my findings as you see here on the screen. 598 598
But the great thing 599 599
is if I ran other searches from other modules, 600 600
and they found contacts, 601 601
they would also be in this table, 602 602
and I could easily see those, too. 603 603
Now hopefully, you're starting to see 604 604
how all of this starts coming together. 605 605
And you're going to play with it a little bit more on your own. 606 606
As I said before, the thing that's going to make you 607 607
a great cybersecurity analyst is hands on the keyboard, 608 608
practicing with this stuff, 609 609
doing different reconnaissance evolutions, 610 610
trying to find information that's out there. 611 611
Now, the great thing about open source intelligence 612 612
and learning how to do this 613 613
is that all the information is out there. 614 614
You don't need permission from any of these companies 615 615
to go look up this information, 616 616
because it's all public information that's sitting online. 617 617
And this is a great way for you 618 618
to start building up your skills 619 619
early on in the reconnaissance process. 620 620
'Cause as long as you're doing passive reconnaissance, 621 621
you're not touching that company servers, 622 622
and you are not conducting any kind of hacking. 623 623
You're just in the preparation phases. 624 624
You're just learning information. 625 625
And using these tools and getting better at them, 626 626
it's going to make you a better analyst or pen tester 627 627
in the long run.