Skip to content
Lesson 3 of 8

Reconnaissance

8 min read

What Reconnaissance Is

Reconnaissance is the first technical phase of a pentest and consists of gathering as much information as possible about the target before interacting directly with its systems. The better you understand the attack surface — domains, subdomains, IP addresses, technologies, employees, vendors — the more effective and targeted every later phase will be.

Well-done reconnaissance saves time and reduces noise. Instead of scanning blindly, you reach the scanning phase with a clear map of which assets exist and which are most promising. A real attacker invests much of their effort here, and a professional pentester should do the same within their authorized scope.

Method matters as much as tooling. Work from the general to the specific: first delimit what belongs to the organization (root domains, IP ranges, brands), then branch out toward subdomains, services, and people. Document each finding with its source and its date, because infrastructure changes and a stale data point can lead you to wrong conclusions. Always ask the "why" behind each query: you do not collect data to accumulate it, but to answer a concrete question that guides the next phase.

Ethical framing: even when information is public, collecting it about assets outside the authorized scope can be problematic. Stay within scope.

Passive Reconnaissance

Passive reconnaissance gathers information without sending direct traffic to the target's systems, which makes it practically undetectable. You use third-party sources: public records, search engines, social media, TLS certificates, and intelligence databases. Because you do not directly touch the target's infrastructure, the risk of alerting defenses is minimal.

Classic examples include querying WHOIS records for domain data, using historical DNS records, reviewing certificates on crt.sh to discover subdomains, or searching Shodan and Censys for previously indexed exposed services. These platforms maintain data they already collected, so querying them generates no traffic toward the target.

A common first step is to check the domain's registration data, which reveals name servers, dates, and sometimes contacts:

# Shows the domain's public registration data (registrar, nameservers, dates)
whois example.com

Certificate transparency is a goldmine of subdomains, because every issued certificate is recorded in public logs. You can query it from the browser at https://crt.sh/?q=%25.example.com, or conceptually with curl against its JSON API:

# Queries certificate transparency and extracts hostnames associated with the domain
curl -s "https://crt.sh/?q=%25.example.com&output=json"

Passive reconnaissance is the ideal starting point because it builds a broad picture without raising alarms. Only when you exhaust passive sources should you move to more active techniques.

OSINT: Open Source Intelligence

OSINT (Open Source Intelligence) is the discipline of obtaining intelligence from publicly available information. It includes employees' LinkedIn profiles, GitHub repositories where credentials or configurations sometimes leak, public documents with revealing metadata, and mentions on forums or social media.

Tools like theHarvester collect emails, subdomains, and names associated with a domain from multiple public sources. Maltego visualizes relationships between entities — people, domains, IPs, emails — helping to understand the organizational structure. SpiderFoot automates OSINT collection from hundreds of sources and correlates it automatically.

# Collects emails, subdomains, and hosts for the domain from public sources
theHarvester -d example.com -b all

The value of OSINT lies in the human and organizational: employee names useful for social engineering (in engagements that include it), technologies revealed in job postings, or email naming conventions that facilitate authorized brute-force attacks. All this public information paints a portrait of the target before touching a single port.

Infrastructure Footprinting

Footprinting is the process of mapping the target's technical footprint: which domains and subdomains it owns, which IP ranges it uses, which hosting and CDN providers it employs, and which technologies it runs. The goal is to build a complete inventory of assets before scanning.

To enumerate subdomains passively you can lean on tools that query public sources and aggregate them for you:

# Enumerates subdomains from passive sources (fast and quiet)
subfinder -d example.com

# Passive subdomain enumeration correlating multiple data sources
amass enum -passive -d example.com

The DNS infrastructure reveals a lot about mail providers, name servers, and policies. Querying the different record types tells you who hosts what:

# Queries all available records for the domain
dig example.com ANY

# Shows only the mail servers (MX records)
dig +short mx example.com

# Lists the domain's authoritative name servers
host -t ns example.com

Identifying web technologies — frameworks, servers, CMS — can be done with Wappalyzer or WhatWeb. Knowing that a site runs a specific version of WordPress or a particular server steers the following phases toward known vulnerabilities of those technologies.

Active Reconnaissance

Active reconnaissance involves interacting directly with the target's systems, which generates potentially detectable traffic. It includes targeted DNS resolution, pings, traceroutes, and direct queries to services. It is noisier than passive recon, but also more precise, since it confirms in real time which assets are alive and accessible.

For example, a misconfigured DNS zone transfer (AXFR) can reveal an organization's entire list of internal hosts. A properly configured name server rejects this query; a misconfigured one hands you the entire zone:

# Attempts a zone transfer against the nameserver (only with authorization)
dig axfr @ns1.example.com example.com

Live host discovery via ping sweeps or ARP probes confirms which addresses respond. These techniques mark the transition toward port scanning, which we will see in the next lesson.

Because active reconnaissance leaves a trace, it is wise to balance depth and stealth according to the rules of engagement. If the test's goal includes evaluating the client's detection capability, you can be deliberately noisy; if not, you moderate the intensity to avoid overloading systems.

Recon in MITRE ATT&CK

The MITRE ATT&CK framework documents adversary behavior in tactics and techniques, and gives reconnaissance its own place: the Reconnaissance (TA0043) tactic. Placing your work within this framework helps you think like the attacker and communicate findings in a language the defensive team (Blue Team) understands.

Within that tactic, several techniques describe exactly what you do in this phase:

  • Gather Victim Identity Information (T1589): emails, names, and credentials associated with people in the organization — the domain of OSINT.
  • Gather Victim Network Information (T1590): domains, IP ranges, DNS, and topology — the domain of footprinting.
  • Search Open Websites/Domains (T1593) and Active Scanning (T1595): the passive versus active axis we covered above.

Mapping each activity to its ATT&CK technique is not bureaucracy: it makes your report more actionable, because the client can cross-reference your findings with their detection controls technique by technique.

Mini-scenario: from recon to attack plan

Imagine an authorized engagement against example.com, scoped to that root domain's corporate assets. You start passive: whois confirms the registrar and the nameservers; crt.sh returns a list of subdomains from which vpn.example.com, mail.example.com, and dev-legacy.example.com stand out. That last one, from its prefix, smells like a stale environment.

You add OSINT: theHarvester reveals a handful of emails with the pattern initial+lastname@example.com, and a job posting mentions a specific technology in the stack. With dig and subfinder you complete the DNS map and confirm which subdomains resolve to IPs within scope. In a few steps, without launching a single exploit, you already have prioritized hypotheses: dev-legacy as a weak candidate, an email pattern for authorized access testing, and a VPN portal as a sensitive surface. That map is exactly what guides the scan and the following phases.

From Information to Action

Reconnaissance only has value if you organize and analyze what you collect. Centralize domains, IPs, technologies, and people in a clear structure that feeds the following phases. A good practice is to maintain a spreadsheet or asset database that grows throughout the engagement.

Reconnaissance is not a one-time event: it is continuous. As you scan and exploit, you will discover new assets that warrant returning to recon techniques. Treat this phase as an iterative cycle and keep your attack-surface map always updated and within the authorized scope.

Closing checklist

Before you consider the reconnaissance phase complete, verify:

  • [ ] Consolidated inventory of domains and subdomains, with source and date.
  • [ ] IP ranges and hosting/CDN providers identified and validated against the scope.
  • [ ] Relevant DNS records (MX, NS, TXT/SPF) documented.
  • [ ] Detected web technologies and versions noted per asset.
  • [ ] OSINT findings (emails, people, public leaks) organized and with context.
  • [ ] Each finding mapped to its MITRE ATT&CK technique where applicable.
  • [ ] Everything verified within the authorized scope; out-of-scope assets discarded.