Network Reconnaissance with Recon-NG – Basic Usage

I am working on a major update for my first book, “Basic Security Testing with Kali Linux”. Since it was published, the Recon-NG tool has changed a bit. I figured I would post a series of articles on how to use the newer Recon-NG.

The Recon-NG Framework is a powerful tool that allows you to perform automated information gathering and network reconnaissance. Recon-NG automates a lot of the steps that are taken in the initial process of a penetration test. You can automatically hit numerous websites to gather passive information on your target and even actively probe the target itself for data. It has numerous features that allow you to collect user information for social engineering attacks, and network information for network mapping and much more.

Think of it as Metasploit for information collection. Anyone who is familiar with Metasploit will feel right at home as the interface was made to have the same look and feel. The command use and process flow are very similar. Basically you can use Recon-NG to gather info on your target, and then attack it with Metasploit.

Using Recon-NG

You can start Recon-NG by selecting it from the ‘Applications > Information Gathering’ menu, or from the command line:

  • Open a terminal window by clicking on the “Terminal” icon on the quick start bar
  • Type, “recon-ng”:

Basic Recon-ng 1

Type, “help” to bring up a list of commands:

Basic Recon-ng 2

Now type, “show modules” to display a list of available modules:

Basic Recon-ng 3

Modules are used to actually perform the recon process. As you can see there are several different ones available. Go ahead and read down through the module list. Some are passive; they never touch the target network, while some directly probe and can even attack the system you are interested in. If you are familiar with the older version of Recon-NG you will notice that the module names look slightly different. Kali 2 includes the latest version of Recon-NG, and the module name layout has changed from previous versions.

The basic layout is:

Basic Recon-ng 4

1. Module Type: Recon – This is a reconnaissance module.
2. Conversion Action: Domains-hosts – Converts data from “Domains” to “hostnames”.
3. Vehicle used to perform Action: Google _Site_Web – Google is used to perform the search.

So from this module name we can see that it is a recon module that uses Google’s web site search to convert Domain Names to individual Hosts attached to that domain.
When you have found a module that you would like to try the process is fairly straight forward.

  • Type, “use [Modulename]” to use the module
  • Type, “show info” to view information about the module
  • And then, “show options” to see what variables can be set
  • Set the option variables with “set [variable]”
  • Finally, type “run” to execute the module

Stay tuned for additional Recon-NG articles and my re-vamped Basic Kali book. Also, check out my latest book, “Intermediate Security Testing with Kali Linux 2” which contains almost 500 pages packed full of step-by-step tutorials using the latest penetration testing tools!


Intermediate Security Testing with Kali Linux 2 Released!

Security Series

Introducing my new book, “Intermediate Security Testing with Kali Linux 2“!

The second book in my Kali Linux series has been released. Picking up where “Basic Security Testing with Kali Linux” left off, this book delves deeper into using post exploitation techniques. It also covers Web Application testing using tools like Burp Suite. It then turns to testing smart devices like Android Phones and tablets. And even includes an entire section on using the Forensics tools in Kali to perform computer security testing.

Topics Include:

  • New Metasploit Features and Commands
  • Creating Shells with Msfvenom
  • Post Modules & Railgun
  • PowerShell for Post Exploitation
  • Web Application Pentesting
  • How to use Burp Suite
  • Security Testing Android Devices
  • Forensics Tools for Security Testing
  • Security Testing an Internet of Things (IoT) Device

And much, much more!

This book was originally written for the first version of Kali and was ready to be released last month. But as the new Kali 2.0 was released I held the book back and completely updated the entire book from beginning to end to cover the new OS and any tool changes. So in essence as it took about a year and a half to write this book, all the information in it has been updated as of this month!

If you are still using the original Kali, not a problem the tools work the same in both versions, though I do recommend updating to the new Kali 2.0 as it has a much better interface and menu system. If you are still using Backtrack, please update to Kali 2 you will thank yourself!

The second book dwarfs the first in both size and content. I took to heart all of the feedback from my first book. I had a lot of request to add more tool coverage, so I added two entire chapters covering included tools and their use. Multiple people asked me to cover the forensics tools, so I added an entire section devoted to security testing with Kali’s Forensics tools. Several people had told me that the first book was confusing in places, as I had an extra month to work on the book before publishing, hopefully this book will be easier to follow and understand than the first.

I even included a chapter on testing Internet of Things (IoT) devices. As IoT devices are becoming all the rage, security testing them is of high importance. We will have an eye opening look at an actually physical security device in use today that has some serious vulnerabilities.

As always, thank you so much for your support and encouragement. The overwhelming support I have received from individual users, technical trainers, corporations, universities, law enforcement agencies and members of the military has been both humbling and an absolute honor. Thank you!

Intermediate Security Testing with Kali 2 Linux