Why Most Pentesters Skip External Recon and Pay for It Later

#The Domain Already Told You Everything. You Just Weren't Listening.#link

Every internal AD assessment I've run in the past four years started the same way: the client hands you a CIDR range, maybe a domain name, and says "go." What they don't tell you is that their public-facing infrastructure is leaking the internal username format, the email schema, and sometimes even the password policy through job postings and document metadata.

External reconnaissance isn't optional. It's the difference between spraying Welcome1 at 3,000 random usernames and spraying Spring@2024 at 47 confirmed valid accounts you scraped from their LinkedIn page. One gets you locked out. The other gets you a foothold in ninety seconds.

What data points actually matter before you touch the internal network?

This tells you immediately that Inlanefreight doesn't self-host. Their infrastructure lives in DigitalOcean's space. That means you need explicit written approval before scanning anything, because you're technically touching DigitalOcean's network. Smaller companies almost always host in someone else's ASN. Miss this step and you could cause an incident with a third party you have zero authorization to test.

How do you extract username formats from public sources?

Google dorking the company website for contact pages reveals email addresses. The format of those emails IS the internal username format in most organizations. If you see john.smith@inlanefreight.com on their "About Us" page, the AD username is almost certainly jsmith or john.smith. Confirm this by checking document metadata on any PDFs they've published.

Breach data from HaveIBeenPwned or Dehashed can reveal old passwords. Users are creatures of habit. If Jane Yu used Starlight1982_! on MyFitnessPal in 2019, there's a non-trivial chance her AD password follows a similar pattern. You won't use these directly against AD, but they inform your password spray wordlist.

The username list you build here feeds directly into Kerbrute for internal validation. You just went from zero knowledge to a targeted list of 200+ probable usernames without sending a single packet to their internal network. That's the power of doing recon properly before you start attacking.