Reconnaissance Basics

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Reconnaissance Basics without the intimidation factor
Get hands-on running tools yourself in an authorized lab environment
Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

Passive recon means gathering public information (company website, LinkedIn, DNS records, WHOIS) without ever directly touching the target — the target has no way of detecting this activity, since no traffic is sent directly to it. Active recon means directly touching the target (port scans, pings) to gather information — the target's firewall/IDS can detect this activity, since it leaves traces in traffic logs. OSINT (Open Source Intelligence) is really just the formal name for passive recon — the whole discipline of gathering information from public data sources.

Let's connect it to a real scenario

Say you're doing an authorized pentest on a company — as passive recon, you could search the company website for employee name/email patterns (e.g., firstname.lastname@company.com), study the IT staff structure on LinkedIn, or look up domain registration info with the `whois` command — the target has no way of knowing any of this happened. Active recon (port scanning, Basic lesson 6) should only begin once you actually have scope/authorization.

Passive recon = gathering public info without touching the target (undetectable)
Active recon = directly touching the target (can be detected)
OSINT = the formal discipline name for passive recon

Let's look at an example together

bash

# Passive recon examples (safe, no direct contact with the target's systems)
whois example.com
dig example.com ANY
nslookup example.com

# These only query public DNS/registry databases —
# they don't send traffic to the target's own servers.

You should see

$ whois example.com
Domain Name: EXAMPLE.COM
Registrar: ...
Creation Date: ...

Try it in 5 minutes

Run the `whois` command against your own domain (or a well-known public domain) — write down two ways an attacker could make use of the information in the output.

A quick word of caution

Don't assume passive recon is completely harmless to the target — gathering personal information from social media can raise real privacy concerns; only do recon within the scope of an authorized engagement.

Easy traps

Thinking there's 'no real difference' between passive and active recon — active recon can leave traces in the target's logs/alerts
Assuming OSINT is only a 'hacking technique' — journalists, researchers, and HR teams also use OSINT for legitimate purposes like background checks

Now try it yourself

Run the `whois` command against your own domain (or a well-known public domain) — write down two ways an attacker could make use of the information in the output.

You'll know it worked when: $ whois example.com Domain Name: EXAMPLE.COM Registrar: ... Creation Date: ...