# 9. Footprinting using footprinting tools

## 1. Footprinting with Recon-ng

Start the tool

```
recon-ng
```

install all the modules

```
marketplace install all
```

list all modules

```
modules search
```

Now create a workspace and select it

```
workspaces create CEH
workspaces select CEH
```

<figure><img src="/files/k87Hj8p6GsRMCTUETVym" alt=""><figcaption></figcaption></figure>

```
workspaces list //if you want to see the list of workspaces
```

Add a website to the recon list

```
db insert domains
show domains // to list the domains
```

<figure><img src="/files/TtHf1e0ZmXcutlSDJ7Si" alt=""><figcaption></figcaption></figure>

load the module for brute forcing hosts

```
modules load recon/domains-hosts/brute_hosts
```

Now  run it with run command

You can view the hosts with the following command

```
show hosts
```

Now to resolve the host with bing

```
back
modules load recon/domains-hosts/bing_domain_web
run
```

Now reverse lookup

```
back
modules load recon/netblocks-hosts/reverse_resolve
```

create a report

```
modules load reporting/html
options set CREATOR ammar
options set CUSTOMER ceh
```

**Whois with Recon-ng**

create a new workspace

```
workspaces create whois
workspaces select whois
```

Now select the whois module

```
modules load recon/domains-contacts/whois_pocs
```

Set the website as target

```
options set source SOURCE google.com
```

**Check the names and usernames on social media.**

```
modules load recon/profiles-profiles/namechk
```

```
options set SOURCE ammar
```

**checking profiles on social media (very good results)**

```
modules load profiler
options set SOURCE ammar
run
```

**Getting subdomains and other info about the target (Most important)**

```
modules load hackertarget
options set SOURCE certifiedhacker.com
run
```

<figure><img src="/files/kH0N85BcYK57IVLM113K" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">2. Maltego recon</mark>

website>DNS using name schema>DNS SOA>DNS Mx>DNA nameservers>DNS IP address>location>

website>domains>whois

## <mark style="color:red;">3. OSRFramework</mark>

Good for quickly finding subdomains.

{% embed url="<https://github.com/i3visio/osrframework>" %}

```
sudo pip3 install osrframework //installation
```

Run as root.

```
domainfy -n eccouncil -t all
```

{% hint style="info" %}
-n specify nickname of  domain

-t specify list of top level domains where nick will be searched
{% endhint %}

<figure><img src="/files/8cya1NJN9N1o69o9P9rE" alt=""><figcaption></figcaption></figure>

**Finding user accounts of a username**

```
searchfy -q ammar
```

{% hint style="info" %}
-q specifies the query
{% endhint %}

![](/files/e9NfERLdQygBgA4ubfZr)

## <mark style="color:red;">4. Footprinting using FOCA (windows)</mark>

Domains and document analysis

## <mark style="color:red;">5. Billcipher</mark>

Allows to select the modules do the recon.

{% embed url="<https://github.com/bahatiphill/BillCipher>" %}

## <mark style="color:red;">6. OSINT Framework</mark>

{% embed url="<https://osintframework.com/>" %}

## Other tools

{% embed url="<https://github.com/s0md3v/ReconDog>" %}

{% embed url="<https://github.com/TebbaaX/GRecon>" %}

{% embed url="<https://github.com/Moham3dRiahi/Th3inspector>" %}

{% embed url="<https://github.com/evyatarmeged/Raccoon>" %}

### Best CEH V13 Practical Course

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ceh-practical.cavementech.com/module-2.-footprinting-and-reconnaissance/9.-footprinting-using-footprinting-tools.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.