Employing comprehensive reconnaissance applications
Although Kali contains multiple tools to facilitate reconnaissance, many of the tools contain features that overlap, and importing data from one tool into another is usually a complex manual process. Most testers select a subset of tools and invoke them with a script.
Comprehensive tools focused on reconnaissance were originally command-line tools with a defined set of functions; one of the most commonly used was the Deep Magic Information Gathering Tool (DMitry). DMitry could perform whois lookups, retrieve netcraft.com information, search for sub-domains and email addresses, and perform TCP scans. Unfortunately, it wasn’t extensible beyond these functions.
Figure 3.7 provides details on running DMitry on www.cyberhia.com. The following command can be used to enumerate the reverse DNS to IP lookup, Whois, subdomain, email address, and open port details:
sudo dmitry -winsepo out.txt www.cyberhia.com
Figure...
