Information gathering tools are utilities that collect information about a target network, system, domain or web application. They support both passive reconnaissance, where information is collected without directly interacting with the target and active reconnaissance, where the target is probed to discover live hosts, ports and services.
1. Nmap
Nmap (Network Mapper) is a network discovery and security auditing tool used to identify live hosts, open ports, running services, operating systems and firewall configurations. Example:
nmap -A 192.168.1.102. Netdiscover
Netdiscover identifies active devices on a local network using ARP requests. It is particularly useful when DHCP information is unavailable. Example:
netdiscover -r 192.168.1.0/243. Whois
Whois retrieves registration details of a domain, including registrar information, registration dates and authoritative name servers. Example:
whois example.com4. Dig
Dig (Domain Information Groper) queries DNS servers to retrieve records such as A, AAAA, MX, TXT, NS and CNAME. Example:
dig example.com ANY5. DNSRecon
DNSRecon performs advanced DNS enumeration by collecting records, discovering subdomains and attempting DNS zone transfers. Example:
dnsrecon -d example.com6. TheHarvester
TheHarvester gathers publicly available information from search engines, certificate transparency logs and other online sources. Example:
theHarvester -d example.com -b google7. Recon-ng
Recon-ng is an OSINT framework that automates reconnaissance using modular data collection techniques. Key Features Automated reconnaissance, Workspace management, Reporting support. Example:
recon-ng8. Maltego
Maltego is a graphical intelligence gathering platform that visualizes relationships between domains, IP addresses, organizations, Link analysis, OSINT integration, Infrastructure visualization and other entities.
9. Amass
Amass performs in-depth asset discovery and attack surface mapping using multiple OSINT data sources. Key Features Subdomain enumeration, DNS intelligence, Asset discovery, Attack surface mapping. Example:
amass enum -d example.com10. WhatWeb
WhatWeb identifies technologies used by websites, including web servers, CMS platforms, frameworks and security solutions. Example
whatweb example.com11. Wafw00f
Wafw00f detects whether a web application is protected by a Web Application Firewall (WAF). Key Features Vendor identification, Security assessment support. Example
wafw00f https://example.com12. Gobuster
Gobuster discovers hidden directories, files, virtual hosts and DNS subdomains using wordlists. Example:
gobuster dir -u https://example.com -w wordlist.txt13. Enum4linux
Enum4linux extracts information from Windows systems using the SMB protocol. Key Features User enumeration, Share enumeration, Group information, Domain details. Example:
enum4linux -a 192.168.1.2014. SMBMap
SMBMap enumerates SMB shares and their access permissions across Windows systems. Key Features Permission analysis, File listing, Access validation. Example:
smbmap -H 192.168.1.2015. SSLScan
SSLScan analyzes SSL/TLS configurations of servers to identify supported protocols, cipher suites and certificate details. Example:
sslscan example.comBest Practices
- Obtain proper authorization before scanning any target.
- Combine passive and active reconnaissance for comprehensive results.
- Use multiple tools to validate collected information.
- Keep reconnaissance logs for analysis and reporting.
- Update Kali Linux and reconnaissance tools regularly to access the latest features and detection capabilities.
