Recon & OSINT

Recon Tools Deep Dive

Master the full recon toolchain — amass, subfinder, httpx, waybackurls, gau, nuclei, and nmap — and learn how to pipe them together into an automated reconnaissance pipeline that maps an entire target's attack surface.

Intermediate50 min6 lessons1 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Master amass, subfinder, and httpx for systematic asset enumeration
✓Build a recon pipeline that feeds results from one tool into the next
✓Use Shodan and FOFA APIs for automated attack surface monitoring
✓Produce a complete target profile ready for exploitation

Lessons

1The Recon Pipeline — Why Tool Chaining Matters
2amass and subfinder — Subdomain Enumeration
3httpx, waybackurls, and gau
4Your Turn: Pull Old URLsHANDS-ON
5nuclei and nmap
6Final Assessment — Recon Tools Deep Dive

Start free →