Chapter 2 of 9 · EC-Council 312-50
Reconnaissance Techniques
Footprinting, network scanning and enumeration, with the tools and countermeasures for each.
- 8topics
- 39 minfast track
- 1diagrams and exhibits
- 17%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Footprinting Concepts and MethodologyUnderstand footprinting: passive versus active reconnaissance, the information attackers collect and the stages of the CEH…4 min
- 2Search Engines, Web Services and Social NetworksLearn passive footprinting with search engine operators, Shodan and Censys, job sites, web archives and social networks, and what…4 min
- 3Website, Email, Whois and DNS FootprintingLearn website mirroring and header analysis, email tracking, Whois registration data and DNS records and zone transfers for the…5 min
- 4Network Footprinting, Social Engineering, Tools and CountermeasuresLearn network range lookup and traceroute, human-based footprinting, common footprinting tools and the countermeasures that limit…5 min
- 5Scanning Concepts, Host and Port DiscoveryLearn network scanning for the CEH exam: TCP flags, ping sweeps, Nmap host discovery and port scan types, port states and common…Diagram6 min
- 6OS Discovery and Evading IDS and FirewallsLearn banner grabbing and OS fingerprinting, how scans try to slip past IDS and firewalls at concept level, and the…5 min
- 7Enumeration Concepts, NetBIOS, SNMP and LDAPLearn enumeration for CEH: what it collects, key ports, NetBIOS names and nbtstat, SNMP community strings and MIBs, and LDAP…5 min
- 8NTP, NFS, SMTP, DNS and Other EnumerationReview enumeration of NTP, NFS, SMTP, DNS, IPsec, VoIP, RPC, FTP, SMB, IPv6 and BGP with their ports and tools, and the…5 min
About this chapter
What this chapter covers
This chapter is 17% of the EC-Council CEH v13 312-50 exam, the second largest share after network and perimeter hacking. It covers how an attacker, or an ethical hacker, learns about a target: footprinting, network scanning and enumeration.
It stays at the level of concepts and exam objectives. You will not find working attack procedures, because the exam tests whether you recognize the technique, the tool or the countermeasure. Questions are single-answer multiple choice.
It has 28 outline topics, grouped into eight pages.
How the topics fit together
Reconnaissance moves from quiet information gathering to direct probing and then to extracting details from the services found.
- Footprinting collects information from search engines, websites, email, Whois, DNS, social networks and people.
- Scanning finds live hosts, open ports, services and operating systems, and it includes ways to get past filters.
- Enumeration pulls user names, shares and service data from the services that scanning found.
Learn the Nmap scan types and the default port of each enumeration protocol. Both appear in many scenario questions.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to match each short scenario to its attack category before reading the answer. The exam often describes symptoms and asks for the attack name or the best fix.
Ready for more practice?
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.