Information Gathering
The recon phase: passive and active discovery of hosts, services, domains, people, and an organization’s broader footprint, before any deeper testing starts. Most engagements begin here.
| Tool | Source | Notes |
|---|---|---|
| nmap | official | Port/service scanner |
| gobuster | official | Directory/DNS/vhost brute-forcer |
| ffuf | aur | Fast web fuzzer |
| dirb | aur | Classic content discovery |
| masscan | official | Ultra-fast port scanner |
| maltego | aur | Link-analysis / OSINT graphing |
| theharvester-git | aur | Email/subdomain/IP harvesting |
| sherlock | aur | Username search across sites |
| recon-ng | aur | Web recon framework — currently broken (unresolvable AUR build dependency) |
Several webapp shortcuts complement this category directly: Shodan, Censys, Have I Been Pwned, PimEyes, urlscan.io, and the OSINT Framework.