Reconnaissance is learning about a target before acting. Defenders study it because it shows what information they unintentionally expose, and authorized testers use it to plan accurately.

Passive reconnaissance

Passive recon gathers public information without touching the target’s systems, so it is hard to detect. Sources of this open-source intelligence (OSINT):

  • Public DNS records and WHOIS registration data.
  • Search engines and cached pages.
  • Certificate transparency logs, which list issued TLS certificates and reveal subdomains.
  • Job postings that mention the technologies a company uses.
  • Social media and staff directories that reveal names and email formats.
  • Code repositories that may accidentally contain credentials.

Defensive lesson: audit what your own organization publishes. Remove secrets from repositories, limit staff details online and trim unnecessary public DNS entries.

Active reconnaissance and enumeration

Active recon interacts directly with target systems, so it can be logged and detected, and it must only be done within an authorized scope. Typical goals:

  • Host discovery: which addresses are alive.
  • Port scanning: which ports are open, meaning which services are listening.
  • Service and version detection: what software is running, which maps to known CVEs.
  • Enumeration: pulling detail from a service, such as shares, user lists or banner information.

In a lab you own, a basic scan of your own VM looks like:

nmap -sV 192.168.56.101

Here -sV asks Nmap to identify service versions. Compare results to what you expect to be running; every unexpected open port is a finding.

Interpreting results

  • Open port 22 suggests SSH, 80/443 web, 3389 Remote Desktop, 445 file sharing.
  • Old version numbers point to missing patches.
  • Verbose banners leak information and should be minimized.

Defending against recon

  • Close unused ports and services; use a default-deny firewall.
  • Monitor for scan patterns (many ports from one source in seconds) with IDS rules.
  • Rate-limit and alert on enumeration attempts such as repeated failed lookups.
  • Use generic error messages and hide version banners.
  • Keep an asset inventory so you know your exposure before anyone else does.

Always scan only what you own or are authorized in writing to test.

Check your understanding

1. What distinguishes passive from active reconnaissance?

  • Passive uses the target’s systems directly
  • Passive gathers public information without touching the target
  • Active uses only books
  • There is no difference

Answer: Passive gathers public information without touching the target. This makes it low risk of detection.

2. What does service version detection help identify?

  • User passwords
  • Software that may match known vulnerabilities
  • The target’s favorite color
  • Firewall brand only

Answer: Software that may match known vulnerabilities. Version numbers map to CVEs.

3. Which is a defense against recon?

  • Opening all ports
  • Closing unused services and monitoring for scan patterns
  • Publishing all internal documents
  • Disabling logs

Answer: Closing unused services and monitoring for scan patterns. This reduces exposure and increases detection.

4. Why are certificate transparency logs useful to researchers?

  • They list issued certificates, revealing domains and subdomains
  • They store passwords
  • They block traffic
  • They encrypt email

Answer: They list issued certificates, revealing domains and subdomains. This widens knowledge of the attack surface.

PreviousNext