#NahamCon2022 - @codingo: Recon Fundamentals by Example

Recon taxonomy

Michael Bazzell expands his recon-fundamentals framework: wide recon maps organizational attack surface (domains, assets); narrow recon drills into one target (directory brute force, parameter tampering). Active testing sends requests that create logs; passive testing uses third-party caches without touching the target.

Tool classification

Tools are not binary—Subfinder and Amass support both passive OSINT and active modes, with design intent differing. Proxies like Kaido, Burp, and ZAP are typically narrow-active; ffuf spans narrow and wide active testing. Understanding intent helps manage scope, rate limits, and operational noise.

Emerging tooling

He highlights TruffleHog's safe active verification of passively found secrets, the Kaido proxy, SecurityTrails SQL explorer, and related tools as worth adopting. Bugcrowd's triage lead stresses cataloging behavior over labels when choosing recon stacks for bug bounty or red team work.