Reconnaissance
Overview
Reconnaissance gathers information about a target before deeper testing begins, identifying systems, domains, employees, technologies, and possible entry points within an authorized scope.
Key concepts
- Passive vs. active recon
- OSINT, footprinting
- Domain/email enumeration, technology profiling
How it works
Reconnaissance is the process of gathering information about a target before performing deeper security testing — helping identify systems, domains, employees, technologies, and possible entry points within an authorized scope.
Types of reconnaissance
| Type | What it means |
|---|---|
| Passive reconnaissance | Gathering information without directly interacting with the target's systems. |
| Active reconnaissance | Gathering information through direct interaction with authorized target systems. |
| Open-source intelligence (OSINT) | Information collected from publicly available sources. |
| Footprinting | Building a profile of a target's systems, network presence, and technologies. |
| Domain enumeration | Identifying domains and subdomains associated with an organization. |
| Email enumeration | Identifying email formats, addresses, or mail-related systems associated with an organization. |
| Technology profiling | Identifying operating systems, web servers, frameworks, services, and security products used by a target. |
Core concepts
| Term | Meaning |
|---|---|
| Domain name | A human-readable address used to locate an internet resource. |
| Subdomain | A division of a main domain pointing to a separate service or system. |
| IP address | A numerical address identifying a device on a network. |
| WHOIS record | Public registration information about a domain name. |
| DNS record | Information connecting domain names to services, IP addresses, mail servers, and other resources. |
| Metadata | Information embedded in files that can reveal author, date, location, or software used. |