Reconnaissance Techniques · Topic 1 of 8
Footprinting Concepts and Methodology
Understand footprinting: passive versus active reconnaissance, the information attackers collect and the stages of the CEH footprinting methodology.
- 4 min
- Footprinting is the first phase and is also called reconnaissance.
- Passive means no direct interaction, and active means direct interaction.
- Footprinting gathers organization, network and system information.
What it is
Footprinting is the first phase of hacking. It builds a profile of the target organization: its network, its systems, its people and its security posture.
The goal is to narrow the area of attack and to find the weak points before any direct attack is tried. A good footprint tells the attacker where to scan and whom to impersonate.
How it works
What attackers look for
Footprinting gathers three broad kinds of information.
| Category | Examples |
|---|---|
| Organization | Employee names, job roles, email formats, office locations, partners, technologies in use |
| Network | Domain names, IP ranges, DNS records, network topology, open services |
| System | Operating systems, web server versions, user names, passwords leaked in breaches |
The more complete the picture, the easier it is to choose a technique that works and to avoid detection.
Passive and active footprinting
| Type | Contact with target | Examples |
|---|---|---|
| Passive | None, uses public sources | Search engines, Whois, social networks, job postings, archived pages |
| Active | Direct, may leave traces | Email tracking, website mirroring, traceroute, calls to the help desk |
Passive footprinting is hard to detect because the target never sees the request. Active footprinting is more accurate but may appear in logs.
Information a footprint can reveal
- Technology stack, for example the web server, the content management system or the cloud provider.
- Network ranges and domain names, including forgotten sub-domains.
- Names, roles and contact details that help with social engineering.
- Policies and security measures that have been described publicly.
- Weaknesses such as exposed documents or default pages.
Objectives of footprinting
The aims are to know the security posture, to reduce the focus area, to identify vulnerabilities and to draw the network map. For an ethical hacker the same steps show the client how much an outsider can learn without touching the network.
The footprinting methodology
The CEH methodology groups footprinting by source. Each one is covered on the next pages.
| Stage | What it uses |
|---|---|
| Search engines | Advanced operators and cached pages |
| Web services | Internet-wide search engines, job sites, archives, people search |
| Social networking sites | Employee profiles and posts |
| Website | Page content, headers, mirrored copies, sub-domains |
| Headers and tracking | |
| Whois | Domain registration data |
| DNS | Records and zone data |
| Network | Traceroute and range lookup |
| Social engineering | People as an information source |
Analysis of the results ends the cycle, and the output feeds scanning.
A worked example
An ethical hacker has a company name and nothing else. Searching the web, the registry and the careers page reveals the company's domain, its mail format, its address ranges and the fact that it runs a specific content management system. No packet has reached the target network, so this was passive footprinting.
How the exam asks about this
- "A tester reads job postings and the company blog to learn the technology in use. Which type is this?" -> Passive footprinting.
- "Which type of footprinting involves contact such as mirroring a site?" -> Active footprinting.
- "What is the main purpose of footprinting?" -> To collect information about the target so that the attack area is narrowed.
What to remember for the exam
- Footprinting is the first phase and is also called reconnaissance.
- Passive means no direct interaction, and active means direct interaction.
- Footprinting gathers organization, network and system information.
- Information found here feeds scanning and enumeration.
- Public sources are hard to block, so the best defense is to limit what is published.
A question that says the attacker "queries the target's DNS server directly" is active, even though DNS lookups feel harmless.
Common mistakes
Treating all reconnaissance as passive. Any step that sends traffic to the target or talks to its staff is active.
Thinking footprinting is only about technology. People, roles and policies are part of the profile and often matter most for social engineering.
Forgetting it comes first. Scanning and enumeration depend on the results, so a question asking for the earliest phase points here.
Check yourself
What is footprinting?
The first phase of hacking, collecting information about a target to build a profile and narrow the attack area.
What makes a technique passive?
It gathers information from public sources without direct interaction with the target.
Name the three categories of information collected.
Organization, network and system information.
Topic 1 of 8 in Reconnaissance Techniques
Test yourself on Reconnaissance Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.