I85PREP
⌘ K
CWICP study materials
CWICP study resources

CWICP: Information Gathering and Reconnaissance

CWICP · Work through your exam, one topic at a time.

All guide sections

Information Gathering and Reconnaissance

Reconnaissance tests whether you can map an organization's external surface methodically, staying in scope, and convert raw data into testable hypotheses. The exam rewards passive-first discipline and precise interpretation of DNS, certificate, and metadata sources.

Core sources and what they actually prove

  • Passive DNS and records. A, AAAA, MX, TXT, NS, SOA, CAA, SRV. v=spf1 includes disclose third-party SaaS senders; _dmarc with p=none means spoofing is not blocked; DKIM selectors leak mail vendors.
  • Certificate Transparency (crt.sh, Censys) gives hostnames from SANs, including internal-looking names - historical, so some are dead.
  • Zone transfer. dig AXFR @ns target succeeds only on misconfigured authoritative servers; failure is the normal result, not an error.
  • Subdomain discovery. Wordlist brute force plus permutations; watch for wildcard DNS, which produces false positives unless you compare response bodies and IPs.
  • Virtual hosts. Names that resolve nowhere can still serve content when sent in the Host header against a known IP.
  • Fingerprinting. Header order and values, cookie names, error pages, favicon hashes, /robots.txt, /sitemap.xml, and JavaScript bundles - bundles often carry API routes and keys.
  • Scanning. nmap -sV for services, -sC for safe scripts; treat banners as hints, since versions are spoofable and backported.

Worked example

dig TXT example.com returns v=spf1 include:_spf.google.com include:mail.zendesk.com ~all, and _dmarc.example.com returns p=none. Reasoning: mail is outsourced to two providers, so a spoofed sender may pass alignment checks depending on the DMARC policy - p=none requests reporting but enforces nothing. The ~all softfail further weakens rejection. This is a reportable email-authentication weakness, and it is not a web finding, so keep it in its own section with its own severity rationale.

Traps that cost marks

  • Sending any packet to an asset before confirming it is in scope; cloud-hosted subdomains frequently are not.
  • Presenting CT-log hostnames as live assets without resolution checks.
  • Ignoring wildcard DNS and reporting dozens of duplicate "subdomains".
  • Relying on stale Shodan/Censys banners as current service versions.