Reconnaissance and Information Gathering
Reconnaissance and Information Gathering
This domain tests passive and active information gathering: building an asset and attack-surface picture before exploitation, while staying inside authorization. Questions often ask you to distinguish passive from active collection or to choose the least intrusive way to confirm a finding.
Core rules and concepts
- Passive reconnaissance does not directly touch the target: WHOIS, DNS records, certificate transparency logs, search engines, social media, job postings, GitHub leaks, Shodan, and breach data. It is lower risk but can still be logged by third parties.
- Active reconnaissance sends traffic to target-owned systems: DNS zone transfer attempts, subdomain brute force, port and service scanning, banner grabbing, SNMP queries, and web content discovery. It needs explicit scope and rate limits.
- Map assets, owners, technologies, third parties, and trust relationships. Record source, timestamp, and confidence for every data point.
- Validate third-party data before acting on it; stale DNS and shared hosting often mislead.
- Respect scope: a subdomain found via certificate transparency may resolve to a cloud provider that is out of scope.
Worked example
Scope is *.example.com only. Passive review finds a mail gateway at mail.example.com and a certificate-transparency entry for dev.example.com. A DNS query confirms dev resolves to a third-party SaaS provider. The tester records both, does not scan the SaaS IP, and notes that dev is out of scope unless the client adds the provider. If dev had resolved to an in-scope host, a low-rate HTTP request would confirm the service before any scanning.
Traps that cost marks
- Starting active scans before reading the scope.
- Treating a discovered subdomain as automatically in scope.
- Confusing an A record with a CNAME or forgetting shared hosting.
- Using leaked credentials without authorization.
- Failing to log timestamps and sources, which undermines the report.