Hey everyone,

I’ve been working on a script called Reconis that’s up on GitHub. It’s designed to help with network enumeration and reconnaissance, especially for those of you preparing for the OSCP or working on HTB challenges. Here’s a detailed look at what Reconis can do:

Features of Reconis:

1. Automated Nmap Scans (TCP and UDP):

Reconis automates both quick and detailed Nmap scans. It handles TCP and UDP scans, and you can choose to output results in XML format for further analysis. It also identifies and logs any errors during scanning, so you know exactly what went wrong if something doesn’t work as expected.

2. Vulnerability Scanning:

After identifying open ports, Reconis can run Nmap’s vulnerability scripts (`-sV --script=vuln`) on those ports to check for known issues. The output is cleaned and saved to a file, making it easy to review later.

3. Searchsploit Integration:

The tool integrates with Searchsploit to automatically map discovered services to known vulnerabilities. It processes the JSON output from Searchsploit, filters relevant exploits, and logs them for each service. If Searchsploit doesn't find any exploits, the tool will indicate this in the results.

4. /etc/hosts Management:

Reconis automatically updates the `/etc/hosts` file with domains discovered during scans. Before adding entries, it checks for duplicates to keep the file clean. It extracts domain names and hostnames from the Nmap output and adds them to the hosts file, ensuring proper resolution during further testing.

5. Enum4linux Support:

For Windows environments, Reconis can automate the use of Enum4linux to enumerate SMB shares, users, and other details. The output is cleaned of ANSI escape sequences for readability and is saved for easy reference.

6. Domain Scoring (Experimental):

This feature scores domains based on HTTP headers and status codes to help prioritize which ones might be worth a closer look. It uses a curl command to inspect HTTP responses, scoring domains based on factors like status codes, content length, and the presence of cookies. The best domain for further testing is selected automatically.

7. Feroxbuster Integration:

Reconis integrates with Feroxbuster to automate directory and file discovery on web servers. The tool customizes the file extensions based on the web server detected (e.g., PHP for Apache, ASPX for IIS). You can use the default wordlist provided or specify a custom one if you need something specific.

8.CherryTree Documentation:

All findings from Nmap scans, vulnerability scans, and SMB enumeration are documented in a CherryTree format. The document is structured with nodes for scanning and enumeration, exploitation, and reporting. Each service and port has its own section, including notes, Searchsploit results, and vulnerability scan data.

9. Comprehensive Logging:

Every command executed by Reconis is logged, along with its output. This includes errors and any updates made to system files like `/etc/hosts`. The logging ensures transparency and makes troubleshooting easier.

10. Interactive Prompts:

The tool provides interactive prompts with validation and tab completion, making it user-friendly. You can choose whether to run certain tasks like Feroxbuster or vulnerability scans based on your needs. The prompts guide you through the process, but the script also allows for modifications if you want to customize the commands.

11. Tool Check and Installation:

Before starting, Reconis checks if required tools (like Nmap, Feroxbuster, Enum4linux) are installed. If any tools are missing, it informs you, so you can install them before proceeding.

Why I Made This:

I’m still learning, so this script might have some rough edges. But I figured it could be helpful for others too, especially if you’re prepping for OSCP or doing HTB stuff. I’m planning to add more tools and make the script more customizable. If you try it out and have any feedback or suggestions, I’d be really grateful!

I’m also currently looking for a job in cybersecurity. I recently graduated with a Master’s in Cybersecurity and would love the opportunity to interview if anyone knows of any openings. 😄

Check it Out:

If this sounds useful to you, check out Reconis on GitHub here: https://github.com/empyr3an/Reconis

Thanks for taking the time to read this!

I'm currently enrolled in the pentester path and preparing for CPTS. Taking notes is taking a lot of time than expected. can anyone here share their notes so that I can channel more time into actual studying please? really appreciate the help.

I hope this post is ok for the mods. I imagine it would be, but I also see a world where it isn't, nonetheless :

A couple days ago I posted about advice for dealing with burnout, and seemingly infinite things to learn in this field. The support and validation I had gotten was far more needed than I realized. Thank you :).

Hi everyone, I'm 23 years old and a comic book artist. However, as a child, my first passion was always cybersecurity. I started studying it deeply from the age of 6 or 7, thanks in part to my uncle, who has a degree in computer engineering. Around the end of middle school, I noticed that studying the subject was becoming more and more complex and unsustainable, but I still decided to attend a high school with a focus on computer science. It was incredibly difficult, and the following year I switched to an art school. From that point until graduation, I focused on drawing and later on comics because it was something I also enjoyed, and it didn’t require purely cognitive or mathematical learning. Unfortunately, I’ve always felt bitter about failing at my main passion, especially because I couldn't understand why I was struggling so much. Last December, I discovered that I have ADHD and dyscalculia, which finally explained my academic difficulties. Specifically, I have severe short-term and working memory problems, so I quickly forget what I learn in the short term and can’t mentally process it for problem-solving. This also affects my long-term memory, as I often forget topics I once knew very well. As for dyscalculia, I have serious difficulties with mental calculations and understanding certain logical mechanisms. The tests they ran showed that I have a high intellectual potential but a very uneven cognitive profile. My fluid IQ is 156, but my memory score is only 90! Now, here’s the point: having understood my issues and with more resources to manage them, I’d like to return to studying cybersecurity. But I’m wondering two things: Am I too old? And given my ADHD and dyscalculia, even with a strong intellectual foundation, will mastering the subject be impossible for me? I don’t want sugar-coated answers—I’d rather hear the brutal truth. Thank you.

I know they try to make things intentionally misleading so people will buy the whole course upfront. Even after you pay and unlock the walkthrough, they still suck. The material has been pretty great otherwise. They need to ask for feedback and rely on third-party testing of their material. How can you improve your course if you're not asking any questions about it?

As the title says can anyone give us their experience for the oscp after passing CPTS?

Why does hackers use GitHub instead of using GitLab? is there any differences? I saw most of the bug bounty hunters are using GitHub rather than GitLab.

Hey everyone,

I’m looking to get some feedback on my machine's configuration for cybersecurity, pentesting and ethical hacking purposes.

I’m particularly interested in hearing about:

• Performance: How well would this system handle resource-intensive tasks like running multiple VMs, performing network scans, etc.?

• GPU Acceleration: Is my RX 6800 suitable for tasks like password cracking (e.g., using Hashcat)?

• Any Recommendations: If there are any tweaks, upgrades, or additional tools you’d suggest to optimize the system for cybersecurity work.

Thanks in advance for your insights!

I work as a PenTester in India and would really like to settle in US. I don’t want to do MS. I was thinking if there is any way to directly find a job there.

I have tried applying to jobs in US but the application never moves forward because I am not a citizen.

Pls advice

Hi,

Am doing a couple of CTFs next Sunday and Monday, and I have a shortage in Pwn and reverse fields.

If you're interested in helping me through the CTF in these challenges and earning some quick money for each one you solve, let me know or message me

Hi everybody i am new to cpts and i have finished 3 modules so far but i missed one important thing so far .taking notes i forget about it because i didn't have pre info about the modules anf iwas wondering if any one can offer some notes

Hey, i’m sorry if this is a question I should already know before trying to hack, but i’m currently on a macbook pro 13 and I have been trying all week to find ways to get Kali Linux vm on it. Once I get more money I am going to buy a Lenovo or windows laptop anyway but for now I am sticking with the mac. I’ve tried tons of VM except for parallel and oracle dosent work well on arm64. Is there anything anyone can recommend? like boot kali from an SSD or do I have a dead mission? Any advice I would greatly appreciate.

title sums it up

For a very long time I was very passionate about cybersecurity and white hat hacking but I always thought I'm not smart enough to even try it out. I was so glad to discover the HTB and I'm already deep into the modules.

One thing I discovered is the actual process. Before, I thought exploiting the targets is all about knowing a million different things, but the reality seems to be different. I came to the realization that you don't really need to know HOW to exploit a vulnerability. As long as you found a service with a vulnerable version listening on a port you just execute an exploit with Metasploit and boom, you're in. It's both kinda cool and disappointing.

I know there are very smart people in the field that actually find those vulnerabilities, report them, create exploits that end up in Metasploit, but damn, apparently you don't have to be one of them in order to be a part of this cool white hat hacking community.

The bottom line - super happy to be here and looking forward to getting to the certification at some point!

Feel free to join :) standard rules around sharing content ofc apply. Just noticed there was a lot of discussion here about CPTS. r/htb_cpts

I have been doing the CWES for about 6 months now, outside of school and work. I have abosolutely LOVED the modules, and have learned so many cool things.

For some background, the "ethical hacking" courses at my university are abysmal. The professor calls curling a msfvenom reverse TCP shell onto a Windows VM and then executing it "hacking". For a Cybersecurity degree capstone that is quite stupid, so I came to CWES to actually learn how to manually exploit web environments. So far, it's been EXCELLENT at this, and I have really enjoyed learning all of the cool techniques! The modules have been very well written, and most of the skill assessments are straightforward and very informative.

However, I am almost done, and have started on the last module, "Attacking Common Applications".

What the heck is this module?? I just spent months learning manual exploitation, and am getting excited for the exam, but now I have to sit through a 4 DAY MODULE that is literally "Oh yeah, find out what version is running, or crack a password, and then find an exploit online and use that".

That is hardly useful to me at all. I came to this certification to learn real techniques. If I wanted to learn how to be a script kiddie, I would go watch some YouTube videos.

I haven't finished it, I'm at the end of the Splunk module. Is the rest of the module this useless? Why did the HTB team include this module? Just for getting familiar with the applications? And will I have to use the random exploits that are in this module on the exam?

Maybe I am just frustrated, but what is your take on this module? Am I crazy?

Hi everyone, So 1 have a final in my class (mips) and we download the word doc and answer the questions in microsoft then upload it to the college platform as a reg doc. I know I am going to gets some hate for this, but I was wondering is there any way to cheat by like using microsoft co polit ect without my teacher seeing. He stands basically over us. I have had a very difficult pass 3 weeks, 2 of my family members passed away in a car accident and I am not going to lie it has been hard to focus on anything. Any help appreciated

Is there a big difference between free and premium in Try Hack Me? Starting from Try Hack Me before going to Hack The Box. Thanks.

if possble plz tell where can i find smbclient too

If I saw a walkthrough of the knowledge checkeven if I done the shell using a public exploit and knew about the admin dir in the shell and guessed the password admin:admin and used upload in metasploit to open another shell and the privledge escalation saw it in a walkthrough does that mean I am a failure 😭

How many files exist in the file log?

I’m a full time penetration tester for approximately 10 years. Ive failed the CPTS exam twice. Four attempts total. I am not retaking the exam.

The course content feels like a dumping ground. It’s not focused.

Good luck to everyone seeking the certification. I’ve decided to go back to other providers.