Footprinting and Reconnaissance
Passive versus active
Passive footprinting collects information from third parties - search engines, WHOIS databases, social media, job postings, certificate transparency logs, the Wayback Machine, Shodan - without packets reaching the target. Active footprinting touches the target directly: DNS lookups, zone transfer attempts, traceroute, banner grabbing, email bounce checks. Questions often ask you to classify a technique; if the target's own infrastructure answers the query, it is active.
What to collect
Organizational data (employees, emails, phone numbers, physical locations, technologies, patents, supplier relationships) and network data (domains, subdomains, IP ranges, DNS records, routing, firewall presence). Know the DNS record types: A (IPv4), AAAA (IPv6), MX (mail), NS (name server), CNAME (alias), TXT (SPF/DKIM/verification), SOA (authority and serial), PTR (reverse). Know the five regional internet registries: ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC.
Tools and traps
whois, nslookup, dig, host, traceroute, theHarvester, Maltego, Recon-ng, FOCA, Shodan, Netcraft. Google dorking operators - site:, filetype:, inurl:, intitle:, cache: - appear frequently. Traps: WHOIS is passive, a zone transfer (AXFR) is a target-side query, and a PTR record is not a mail record. Email header analysis reveals relays, originating IPs, and spoofing.
Worked example
You suspect a misconfigured DNS server. The command dig AXFR @ns1.example.com example.com asks the authoritative server to dump the entire zone in one response. If it succeeds you get every hostname and IP without scanning; a refused transfer tells you the server is properly restricted. Rule of thumb: enumerate names from DNS first, then scan only the IPs you now know about.