Chapter 2 of 5 · CompTIA PenTest+ PT0-003
Reconnaissance and Enumeration
Passive and active information gathering, enumeration, Nmap, Wireshark and script changes.
- 6topics
- 28 minfast track
- 4diagrams and exhibits
- 21%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Passive Reconnaissance and OSINTLearn passive reconnaissance and open-source intelligence (OSINT): public sources, DNS and WHOIS records, search engine operators…4 min
- 2Active Reconnaissance and Network SniffingUnderstand active reconnaissance: host discovery, port and protocol scanning, banner grabbing and network sniffing, and how they…Diagram5 min
- 3Enumeration TechniquesLearn enumeration: DNS records and zone transfers, SMB, SNMP, LDAP and SMTP service enumeration, web directory discovery and how…Diagram5 min
- 4Nmap Scan Types and OptionsLearn the Nmap options the PenTest+ exam expects: scan types, port selection, version and OS detection, scripts, timing and…4 min
- 5Wireshark, Shodan and Other Recon ToolsKnow what Wireshark, tcpdump, Shodan, Censys, Maltego, Recon-ng and similar tools are for, and how to choose the right…Diagram5 min
- 6Script Modification for ReconLearn to read and adapt simple Bash, Python and PowerShell scripts for recon: variables, loops, conditions, data structures and…5 min
About this chapter
What this chapter covers
Reconnaissance is how a tester learns about a target before attacking it. Enumeration then pulls detailed information out of the services that reconnaissance finds.
The chapter follows the second domain of the CompTIA PenTest+ PT0-003 outline. It covers where information comes from, how services are probed, which tools do the work, and how scripts are adapted to automate it.
It has four outline topics, and they are spread across six pages because tools and techniques are both large.
How the topics fit together
The pages move from quiet to loud and from broad to detailed.
- Passive reconnaissance uses public data and leaves no trace on the target.
- Active reconnaissance sends packets to find live hosts, open ports, services and operating systems.
- Enumeration asks each service for names, shares, records and hidden content.
- Tools such as Nmap, Wireshark and Shodan do the work, and scripts repeat it at scale.
Whenever a question asks which approach is least likely to be detected, the answer is usually a passive source such as OSINT or an internet-wide search engine.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Practise only on a lab you own or a deliberately vulnerable practice machine. Run each Nmap, dig and tcpdump example there and compare the output with the page.
Ready for more practice?
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.