Reconnaissance and Information Gathering
What the exam tests
Reconnaissance on the PJPT is judged by whether you can build a reliable picture of an Active Directory estate before touching an exploit. The exam expects passive collection first, then low-noise active queries, with every source and timestamp recorded. You must stay inside the authorized scope and avoid actions that could lock accounts or alert defenders.
Core rules and concepts
- Start passive: WHOIS, DNS records, certificate transparency, search engines, and public file metadata.
- Active enumeration should be targeted: DNS zone transfer attempts, SMB share listing, LDAP root DSE queries, SNMP community strings, and web directory discovery.
- Confirm every finding with a second tool or protocol; a single Nmap script output is a hypothesis, not a fact.
- Record IP addresses, hostnames, domain names, usernames, and share paths in a findings log as you go.
- Respect rate limits and account lockout policy; never password-spray during recon unless the rules of engagement explicitly permit it.
Worked example
Scope is 10.10.10.0/24. A passive DNS query returns corp.local and mail records. You attempt dig AXFR corp.local @10.10.10.5; it fails. You then run nslookup against the same server, smbclient -L //10.10.10.5 -N, and enum4linux-ng -A 10.10.10.5. The SMB null session lists shares NETLOGON and SYSVOL; enum4linux-ng returns the domain CORP and a domain controller at 10.10.10.5. Reasoning: the failed zone transfer is not a dead end; SMB and LDAP often reveal the same domain context without brute force.
Traps
Scanning a host outside scope, treating an unverified OSINT hit as a confirmed username, ignoring IPv6, and failing to log the exact command and time of each query. These omissions cost marks in the report even when the technical result is correct.