The six phases in plain language
Think of recon as progressive narrowing. Each phase gives the next phase better input.
- Passive OSINT: domain and DNS context.
- Subdomain enum: find more reachable assets.
- Port scan: identify exposed services.
- HTTP fingerprinting: learn the tech stack and live URLs.
- Directory discovery: expand hidden paths and files.
- Vulnerability scanning: check exposures after the map is built.
When to stop and when to continue
Use recon when you need breadth first. If recon confirms promising URLs or services, move into hunt. If hunt confirms exploitable paths, then consider Abhimanyu.