Structuring Reconnaissance for Attack Planning

Hello! Welcome to the final lesson of the "Penetration Testing Foundations & Reconnaissance" module.

In the previous lessons, you've amassed a significant amount of data about your targets. You've performed passive reconnaissance through Google dorking, code repository analysis, and OSINT, and you've conducted active reconnaissance using Nmap and service-specific enumeration tools. You now possess a collection of IP addresses, open ports, service versions, potential usernames, and other valuable intelligence.

This raw data is useful, but its true power is only unlocked when it's organized. This lesson addresses our final learning outcome for this module: to organize and document your reconnaissance findings in a structured format for attack planning. This is a critical skill that separates professional testers from beginners. Good documentation allows you to see connections, formulate attack strategies, and, ultimately, write the high-quality reports that clients and bug bounty programs require.

---

1. Why Meticulous Note-Taking Matters

Before we dive into the "how," let's solidify the "why." In your future career, whether you're performing a multi-week penetration test or hunting for bugs on a complex application, your notes will be your single source of truth.

Effective documentation serves several purposes:

• Turns Data into Intelligence: It helps you connect disparate pieces of information—like an employee's username from a metadata leak and a vulnerable service running on a server—to form a potential attack path.
• Enables Attack Planning: A structured overview of your findings allows you to prioritize which hosts, services, or applications to target first.
• Forms the Basis of Your Report: The detailed notes, commands, and screenshots you take are the raw material for your final deliverable. Without them, writing a compelling and reproducible report is nearly impossible.
• Ensures Continuity: You may need to pause work on a target and return to it days or weeks later. Good notes let you pick up exactly where you left off without repeating work.

To understand the professional importance of this, let's turn to an industry resource.

---

2. Choosing Your Tools and Methodology

As the article mentioned, tools like Obsidian, OneNote, and Cherry Tree are popular for structured note-taking. The two most prevalent choices in the bug bounty and pentesting communities today are Notion and Obsidian. They support different, but equally valid, methodologies for organizing information.

Approach 1: The Hierarchical Checklist (Notion)

This approach is highly structured and linear. You create a hierarchy of notes for each target and use checklists to track your progress through a defined methodology. This is an excellent way to ensure you are thorough and don't miss any steps.

This video by bug bounty hunter g0lden demonstrates a Notion setup based on the popular methodology created by Jason Haddix.

As you saw, the core idea is to have dedicated sections for different types of data (subdomains, IPs, etc.) and to follow a consistent checklist for every target. This mirrors the structured approach of a professional penetration test.

Approach 2: The Interconnected Knowledge Graph (Obsidian)

This approach is less hierarchical and more like building a "second brain" or a personal wiki. Instead of rigid folders, you create individual notes for each piece of information (an IP, a person, a domain) and link them together. Obsidian's main strength is its ability to visualize these connections as a graph, which can help you spot non-obvious relationships.

Since your background is in Computer Science, you can think of this as creating a graph data structure where your notes are the nodes and the links between them are the edges.

The key takeaway is that with Obsidian, the relationships between notes are just as important as the notes themselves. This non-linear approach can be incredibly powerful for making creative leaps and finding unique attack paths.

---

3. A Practical Template for OSINT and Reconnaissance

Theory is great, but you need a practical system to start with. The following resource provides a set of pre-made templates for Obsidian designed specifically for OSINT investigations. Even if you prefer Notion, the structure of these templates provides a solid foundation for what to document.

This template system gives you a concrete data structure for your findings. Instead of a single messy text file, you'll have organized, interlinked notes. For example:

• You find a domain, corp.com. You create a new note using the Domain template.
• Your Nmap scan reveals an IP, 192.168.1.10. You create a note for it using the Host IP Address template and link it from your corp.com note like this: [[192.168.1.10]].
• Metadata from a PDF on corp.com reveals an author, John Smith. You create a Person note for [[John Smith]] and link it back to the corp.com note.

Your graph view will now visually show that corp.com is related to 192.168.1.10 and John Smith.

Test your understanding!

You're investigating a target. During reconnaissance, you find:

1. A subdomain: dev.example.com
2. An associated IP address: 10.20.30.40, running an SSH service on port 22.
3. A developer's GitHub account, "jane-dev," mentioned in the subdomain's source code.

Using the entity types from the obsidian-osint-templates (Domain, Host IP Address, Account), how would you structure these findings as three interconnected notes?

Show answer

1. Domain Note: Create a note named dev.example.com. In its body, you would add a link to its IP address: Resolved IP: [[10.20.30.40]].
2. Host IP Address Note: Create a note named 10.20.30.40. In its body, you would list the findings from your port scan: - Port 22: Open (SSH). You could also link back to the domain: Associated with: [[dev.example.com]].
3. Account Note: Create a note named jane-dev_GitHub. In its body, you would add a link to her GitHub profile URL. You would also link it to the domain where you found it: Mentioned on: [[dev.example.com]].

Now, your graph will visually connect the subdomain, its IP address, and the associated developer account, giving you a clear picture of the relationships.

---

Conclusion

This lesson concludes our first module on reconnaissance. You've learned how to gather intelligence both passively and actively, and now you have a framework for organizing that intelligence into an actionable format.

Key Takeaways:

• Documentation is a Core Skill: Structured note-taking is essential for planning attacks, collaborating, and writing professional reports.
• Choose a System: Whether you prefer the hierarchical, checklist-driven approach of Notion or the interconnected graph model of Obsidian, adopt a system and be consistent.
• Use Templates for Structure: Define templates for common entities like hosts, people, and domains to ensure you capture the same essential information for each.
• Link Your Findings: The primary goal is to create connections between pieces of data to reveal potential attack paths.

Next Lesson Preview:
You have successfully completed the reconnaissance phase. Your notes are organized, and you have a list of potential targets, including hosts, open ports, and running services. Now, the real fun begins. In the next module, "Network Exploitation & Initial Access," we will take that information and learn how to identify potential exploits for discovered services using search engines and exploit databases. It's time to move from finding targets to attacking them.