The Methodology · 2.2
📜 Reconnaissance
Know your target before you touch it — passive vs active⏱ ~2 min
Reconnaissance (recon) is information-gathering — the foundation of every engagement. The more you understand a target, the more effective and efficient everything after is. Recon comes in two flavors: passive and active.
Passive Recon
- •Gathering info WITHOUT touching the target directly
- •Public records, search engines, social media, job postings
- •The target can't tell you're looking — very low risk
- •This is OSINT — Open-Source Intelligence
Active Recon
- •Directly interacting with the target's systems
- •Pinging hosts, connecting to services, querying DNS
- •Can be detected and logged by the target
- •Requires you to be inside your authorized scope
OSINT — What's Findable Without Touching Anything
Open-Source Intelligence is astonishingly powerful. Before ever sending a single packet to a target, a tester can often learn:
- •Employee names and roles — from LinkedIn and the company website (useful for understanding structure)
- •Technologies in use — from job postings ('must know AWS, React') and public code repositories
- •Domains and subdomains — from public DNS records and certificate transparency logs
- •Email address formats — first.last@company.com patterns, useful for understanding the org
- •Leaked credentials — from past public data breaches (checked via legitimate breach-notification services)
- •Physical and technical footprint — public filings, press releases, and infrastructure details
🔒 SecurityRecon is exactly why the Social Engineering module matters here too — attackers and testers both use OSINT to build a picture of their target. Understanding what's publicly discoverable about an organization is the first step in both attacking and defending it. Reducing your public footprint is a real defensive measure.
💡 TipOSINT is completely legal when you only view publicly available information — you're just reading what's already public. It becomes illegal the moment you use it to access systems without authorization. The gathering is fine; the unauthorized use is the crime.
🧠Quick Checkfirst try = +5 XP
Reading a company's public LinkedIn and job postings to profile it is…
🎮 Practice what you learned
⭐ 0 XP🔥 0 days