External Recon and Enumeration Principles

External reconnaissance is performed before an Active Directory pentest to gather publicly accessible information that can affect the outcome of the engagement. Goals include:

• Validating information in the scoping document
• Ensuring actions are taken against the correct scope
• Identifying publicly accessible information such as leaked credentials

What to Look For

Where to Look

Finding Address Spaces

Use the BGP Toolkit (Hurricane Electric) to research address blocks and ASNs for an organization. Key considerations:

• Large corporations often self-host infrastructure and have their own ASN
• Smaller organizations typically host with third-party providers (Cloudflare, GCP, AWS, Azure)
• Always verify you are not interacting with infrastructure outside your scope
• Some hosting providers (e.g. AWS) have specific penetration testing guidelines; others (e.g. Oracle) require a Cloud Security Testing Notification
• When in doubt, escalate before attacking any external-facing services you are unsure of

DNS Enumeration

Use sites like DomainTools and ViewDNS.info to:

• Validate scope and find undisclosed reachable hosts
• Retrieve DNS resolution data, DNSSEC status, and accessibility info
• Discover additional subdomains residing on in-scope IP addresses
• Cross-validate IP/ASN search results

Public Data

Social Media & Job Postings

• Sites like LinkedIn, Indeed, and Glassdoor can reveal organizational structure, technology stack, software versions, and security implementations
• Job postings may disclose specific software versions (e.g. SharePoint 2013/2016), which hints at potential upgrade-in-place vulnerabilities

Company Websites

• Gather contact emails, phone numbers, org charts, published documents
• Embedded documents may contain links to internal infrastructure or intranet sites
• Check for data inadvertently leaked on GitHub, AWS cloud storage, or other web platforms
• Tools: Trufflehog (credential scanning in repos), Greyhat Warfare (public cloud storage search)

Username Harvesting

Use tools like linkedin2username to scrape a company’s LinkedIn page and generate username permutations:

• flast
• first.last
• f.last

These can be added to password spraying target lists.

Credential Hunting

Dehashed can be used to search for cleartext credentials and password hashes in breach data:

sudo python3 dehashed.py -q inlanefreight.local -p

Results may include email, username, cleartext password, hashed password, and the source database. Test discovered credentials against exposed login portals using AD authentication.

Google Dorking Examples

Overarching Enumeration Principles

Enumeration is an iterative process repeated throughout a penetration test:

1. Start with passive resources, wide in scope, and narrow down
2. Exhaust passive enumeration, examine results
3. Move into active enumeration

Example Enumeration Workflow

1. Check ASN/IP & Domain Data — Use BGP Toolkit to find IP addresses, mail servers, nameservers
2. Validate findings — Cross-reference with ViewDNS.info, nslookup, etc.
3. Harvest public data — Google Dorks for files and email addresses on the target domain
4. Scrape usernames — LinkedIn and other sources
5. Search breach data — Dehashed, HaveIBeenPwned for credential leaks
6. Build wordlists — Combine findings for targeted password spraying

Key Takeaways

• Always save files, screenshots, scan output, and tool output as soon as you find them
• If stuck during a pentest, revisit passive recon for additional leads (e.g. breach data for VPN access)
• The majority of internal AD enumeration can be performed with just low-privilege domain user credentials
• A thorough external recon phase can mean the difference between days of brute-forcing and a quick foothold