Reconnaissance and Footprinting
This domain examines how you gather information about a target without crossing into unauthorized scanning. The exam distinguishes passive reconnaissance, which avoids direct contact, from active reconnaissance, which sends traffic to target systems and therefore needs clear authorization.
Core rules and concepts
- Passive sources include WHOIS, DNS records, certificate transparency logs, search engines, job postings, social media, metadata, and breach data. They can reveal domains, technologies, employees, and email formats.
- Active techniques include DNS zone transfer attempts, subdomain brute force, banner grabbing, and direct queries to target services.
- Validate ownership: a similar domain name, acquired brand, or cloud-hosted asset may belong to a different legal entity.
- Keep a source log with timestamps, URLs, and confidence notes, because reconnaissance findings become report evidence.
- Metadata and leaked credentials are sensitive; handle them under the engagement's data rules.
Worked example
A certificate transparency search shows vpn.example.com and staging.example.com. The scope lists only example.com and its subdomains. Certificate entries are passive OSINT, so viewing them is acceptable. Before resolving or scanning staging.example.com, confirm the scope explicitly includes all subdomains and that the host is not a third-party SaaS instance. If it is hosted by a provider, obtain provider authorization or exclude it. The reasoning separates discovery from interaction and checks asset ownership.
Traps
Do not treat an old WHOIS record as current. Do not run subdomain brute force and call it passive. Avoid scraping a site in violation of its terms or using leaked credentials. A common exam trap is assuming that a public IP address belongs to the client; verify it.