Reconnaissance and Enumeration · Topic 1 of 6
Passive Reconnaissance and OSINT
Learn passive reconnaissance and open-source intelligence (OSINT): public sources, DNS and WHOIS records, search engine operators and what each reveals.
- 4 min
- Passive reconnaissance does not send packets to the target, while active reconnaissance does.
- OSINT draws on public sources such as websites, job posts, social media, WHOIS, DNS and code repositories.
- WHOIS gives registration details, and DNS records give hostnames and mail servers.
What it is
Reconnaissance is the information gathering phase of a penetration test. Passive reconnaissance collects information without sending traffic to the target's systems, so the target cannot easily see it.
Open-source intelligence (OSINT) is the main passive method. It uses public sources such as websites, registries, social media, job postings and search engines.
How it works
Why start passively
Passive work is quiet and safe. It builds a picture of the attack surface, which is everything an outsider could try to reach, before any probing starts.
It also checks the scope. A domain discovered passively that is not listed in the rules of engagement (ROE) must be raised with the client, not tested.
What OSINT can reveal
| Source | Typical information |
|---|---|
| Company website and press releases | Products, partners, office locations, technology names |
| Job postings | Software and platforms in use, such as a database or cloud provider |
| Social media and professional networks | Staff names, roles, email formats, interests |
| WHOIS records | Domain registrant, registrar, name servers, dates |
| Domain Name System (DNS) records | Hostnames, mail servers, address ranges |
| Certificate transparency logs | Subdomains that received public certificates |
| Code repositories | Accidentally published keys, passwords or internal names |
| Breach data collections | Leaked email and password pairs for the organisation |
| Archived web pages | Old pages and files that were removed from the live site |
WHOIS is a query protocol and database that lists who registered a domain or address block. Some registrars now hide personal details for privacy.
Search engine techniques
Search engines support operators that narrow results. Using them to find exposed information is often called Google dorking.
| Operator | Purpose |
|---|---|
| site: | Limit results to one domain |
| filetype: | Find a document type, such as a spreadsheet or PDF |
| inurl: | Match text in the web address |
| intitle: | Match text in the page title |
Used with permission and care, they help find forgotten files and login pages. They also show how much the organisation exposes without trying.
Tools used
| Tool | Purpose |
|---|---|
| theHarvester | Collects email addresses, subdomains and names from public sources |
| Recon-ng | A modular framework for organising OSINT work |
| Maltego | Draws link graphs between people, domains and infrastructure |
| SpiderFoot | Automates collection from many OSINT sources |
| Shodan and Censys | Search engines for internet-connected devices and their banners |
| Wayback Machine | Archive of earlier versions of web pages |
Basic command line lookups also count as reconnaissance.
Linux shell:
whois example.com
dig example.com MX
nslookup -type=NS example.comThese queries go to public registries and DNS servers, not to the client's own hosts in most cases, so they remain mostly passive.
Social engineering preparation
OSINT also supports social engineering tests. Staff names, email formats and public photos help build believable phishing messages for an approved exercise.
Collecting data about employees can create privacy issues, so follow the ROE and keep personal data to the minimum needed.
What to remember for the exam
- Passive reconnaissance does not send packets to the target, while active reconnaissance does.
- OSINT draws on public sources such as websites, job posts, social media, WHOIS, DNS and code repositories.
- WHOIS gives registration details, and DNS records give hostnames and mail servers.
- Certificate transparency logs and code repositories can reveal hidden subdomains and leaked secrets.
- Shodan and Censys index banners from internet-connected devices without the tester touching the target.
- theHarvester, Recon-ng, Maltego and SpiderFoot are the common OSINT tools.
- Search operators such as site: and filetype: narrow search results.
- Anything found must be checked against scope before the next step.
Common mistakes
Calling every lookup passive. A DNS query to the target's own name server, or a visit to its website, produces log entries on the target side, so it may be seen.
Believing public means harmless. Data that is public can still be personal or confidential, and the ROE decides how it may be used.
Assuming Shodan results are current. The data is a snapshot from the last time the service scanned the device, so it must be verified before relying on it.
Skipping scope checks. A related domain, a subsidiary or a cloud account found through OSINT is not automatically in scope.
Treating job postings as trivia. A posting that names a firewall brand or database version is useful input for later vulnerability research.
Check yourself
What makes reconnaissance passive?
It collects information from public sources without sending traffic to the target's systems.
Which tool type indexes banners of internet-connected devices?
Search engines such as Shodan and Censys.
Why can certificate transparency logs help a tester?
They list certificates issued for subdomains, which can reveal hosts the organisation did not advertise.
Topic 1 of 6 in Reconnaissance and Enumeration
Test yourself on Reconnaissance and Enumeration
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.