Reconnaissance and Enumeration
Reconnaissance and Enumeration
Recon splits into two halves, and exams love the distinction. Passive reconnaissance collects information without sending traffic to the target: search engines and Google dorks, WHOIS, DNS records held by third parties, certificate transparency logs, Shodan/Censys, social media, job postings, code repository leaks, and breach data. The target's logs show nothing. Active reconnaissance touches the target's own infrastructure - port and service scanning, banner grabbing, OS fingerprinting, DNS zone transfers, web content/directory enumeration, and service-specific enumeration.
Know the common enumeration targets and what each leaks: SMB (shares, null sessions, OS version), SNMP (community strings, walking MIBs for users, routes, and services), LDAP/AD (naming context, users, groups), DNS (zone transfers, subdomain brute force), SMTP (VRFY/EXPN), and web admin interfaces with default credentials. Nmap scan types matter: a SYN scan is fast and stealthier but needs raw sockets; a TCP connect scan completes the handshake, works without privileges, and is easily logged; UDP scans are slow and ambiguous; FIN/NULL/XMAS scans try to slip past stateless filters. Learn to read port states - open, closed, filtered - and why "filtered" is not "closed."
Traps: classify the technique correctly (a zone transfer against the target's name server is active; certificate transparency is passive), do not mistake a service banner for a confirmed version, remember that service detection and OS fingerprinting generate traffic an IDS can alert on, and note that scanning outside the approved window breaks the ROE.
Rule of thumb: no packets to the target's IPs means passive; anything that reaches them is active and must be in scope.
Enumeration output feeds directly into vulnerability discovery, so record versions, paths, usernames, and shares as you go.