Information Gathering Tools and Techniques
Information gathering tools and techniques
This domain tests passive and active reconnaissance: OSINT, DNS and certificate intelligence, search-engine dorking, metadata, and service discovery. The exam expects you to choose the least intrusive technique that answers the question, stay inside the rules of engagement, and record sources and timestamps.
Core rules
- Start passive: WHOIS/RDAP, DNS records, certificate transparency (crt.sh), ASN and netblock mapping, search engines, code repositories, breach data where lawful.
- Validate passive leads actively only on authorized assets. Host discovery (
nmap -sn) and service/version scans create logs and can disrupt fragile systems. - Separate domain ownership from hosting: a subdomain can resolve to shared cloud infrastructure; an IP scan may touch third parties.
- Capture the source, query, timestamp, and result for every finding; reconnaissance that cannot be reproduced is weak evidence.
Worked example
Scope authorizes example.com only. You query certificate transparency and find vpn.example.com and dev.example.com. You resolve both; vpn points to a corporate netblock, dev to a shared CDN. Reasoning: certificate entries are passive leads, not proof of ownership or live service. You may resolve names, but you should not port-scan the CDN address because it is shared and outside the authorized host boundary. For vpn, confirm the IP is in the agreed scope before any active scan; if the scope is domain-only, request clarification.
Traps
- Treating Shodan/Censys banners as current truth; banners age and change.
- Scanning an entire ASN because one IP belongs to the target.
- Ignoring IPv6, alternate ports, and virtual-host routing.
- Forgetting to check cloud buckets, GitHub leaks, and DNS zone-transfer misconfigurations lawfully.
- Recording “found subdomain” without resolution, ownership evidence, or timestamp.