Reconnaissance and Enumeration
This chapter covers gathering information about a target. You will learn the difference between passive and active reconnaissance, open-source intelligence, DNS and network enumeration, port scanning, and service and operating-system fingerprinting.
Passive versus active reconnaissance
Passive reconnaissance collects information from public sources without directly touching the target's systems, making it stealthy and hard to detect. Active reconnaissance, such as scanning, sends traffic to the target and can be observed by its defenses. Testers often begin passively to build a picture of the attack surface before engaging in active techniques.
Open-source intelligence (OSINT)
OSINT draws on publicly available information such as company websites, social media, job postings, code repositories, and DNS records to learn about an organization's technology, people, and structure. Tools like theHarvester, Recon-ng, and Shodan help collect and organize this data. OSINT can reveal email formats, exposed services, and other clues useful for later phases.
DNS and network enumeration
Enumeration expands the target map. DNS enumeration queries name-server records to discover subdomains, mail servers, and additional hosts, while network enumeration identifies live hosts and reachable services. Building a complete inventory of the exposed attack surface is essential before assessing which components may be vulnerable.
Port scanning and fingerprinting
Port scanning, commonly with Nmap, identifies which ports are open and which services listen on them. Fingerprinting then determines the specific service versions and operating systems present, so the tester can research vulnerabilities that apply to those exact versions. Accurate fingerprinting focuses later effort on realistic, applicable weaknesses.