EH-02: Recon & Enumeration - Mengumpulkan Intel dari Target

Target: Mengumpulkan informasi target sebelum menyerang
Tools: nmap, dig, curl, theHarvester

Praktikum

cd ~ && mkdir -p eth-lab2 && cd eth-lab2

# 1. Port scanning
echo "=== 1. Port Scan ==*"
for port in 22 80 443 8000 8080 8443; do
  timeout 1 bash -c "echo > /dev/tcp/localhost/$port" 2>/dev/null && \
    echo "  ✅ PORT $port - OPEN" || echo "  ❌ PORT $port - closed"
done

# 2. DNS enumeration
echo ""
echo "=== 2. DNS Records ==*"
dig alfarisiazmir.my.id +short 2>/dev/null
echo ""

# 3. Technology fingerprint
echo "=== 3. Technology Fingerprint ==*"
curl -sI  | grep -iE "server|x-powered-by|set-cookie" || echo "(no server header)"

# 4. OSINT - crt.sh (Certificate Transparency)
echo ""
echo "=== 4. Certificate Transparency ==*"
echo "curl -s 'https://crt.sh/?q=%25.alfarisiazmir.my.id&output=json' | jq ."

Output

=== TARGET PROFILE ===
Domain:    alfarisiazmir.my.id
IP:        104.21.x.x
Server:    cloudflare
Open:      80 (HTTP), 443 (HTTPS)
Tech:      Docusaurus, Cloudflare
Subdomain: docs, lab, admin, api

Refleksi: Recon adalah 50% dari pentest. Tools seperti Shodan, Censys, crt.sh adalah senjata utama ethical hacker.

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy