Reconnaissance and Information Gathering
Passive before active
Passive reconnaissance gathers information without touching client infrastructure: WHOIS and RIR records, ASN and netblock mapping, DNS records (A, MX, NS, TXT/SPF/DMARC), certificate transparency logs, search engine and code repository dumps, cloud storage bucket naming, and metadata embedded in published documents. Commercial and open sources (Shodan, Censys) index hosts you have not scanned, which keeps you quiet but does not make the data authoritative.
Active reconnaissance
Once the ROE permits, move to host discovery, port scanning, service and version detection, banner grabbing, virtual host enumeration, zone transfer attempts, and protocol-specific queries (SNMP, LDAP, SMB). Rate control matters: aggressive scans trip IDS and can destabilise fragile devices. Always correlate multiple sources - a port found on one tool and confirmed by another.
Traps in exam questions
- The open port is not a vulnerability. It is an observation that may lead to one.
- Wildcard DNS makes brute-force subdomain enumeration return thousands of false positives; compare response bodies and sizes against a random name.
- Testing a CDN edge IP rather than the origin asset behind it.
- Scope drift: discovery of a related domain does not authorize testing it.
- Mistaking certificate transparency log queries (public data) for active scanning - close enough that the distinction is a common question.
Rule of thumb
Confirm ownership and scope before you touch a discovered host. Discovery creates a question, not a permission.
Worked example: subdomain enumeration returns dev-portal.example.com pointing to a residential IP. You verify via WHOIS and certificate data that it belongs to a contractor, not the client, and you exclude it while documenting the exposure as an observation.