Reconnaissance

Reconnaissance is the first phase of ethical hacking and penetration testing: gathering as much information about a target as possible before attempting any attack. Passive reconnaissance collects public information without touching the target, through OSINT, DNS records, search engines and social media. Active reconnaissance interacts with the target directly, through network discovery, port scanning and service enumeration.

Good reconnaissance decides the success of everything that follows. Learn the techniques in our complete guide to OSINT and attack surface mapping and our network discovery walkthrough. Perform active reconnaissance only against systems you are authorized to test.