Reconnaissance and Target Profiling
Reconnaissance as Structured Discovery
Purpose of Recon
Reconnaissance is the process of learning about a target using approved sources and methods. It can include public records, DNS information, technology fingerprints, employee-facing assets, and visible network exposure.
Passive vs Active Reconnaissance
Passive
- Relies on public or externally visible information
- Lower chance of affecting the target
- Useful early in assessments
Active
- Interacts directly with target systems
- Can produce more detailed results
- May be noisier and more intrusive
Stay in Bounds
Even seemingly harmless requests can cross the line if they are not authorized or if they affect service availability.
Information You Might Collect
Common recon targets include subdomains, hosting providers, exposed services, employee naming patterns, software versions, and third-party dependencies. These details help you build a realistic threat model.
Recon Sources
| Source | Example Insight |
|---|---|
| Organization website | Technology stack hints |
| Certificate records | Subdomain discovery |
| Search engines | Public documents and assets |
| Job postings | Software and cloud platforms in use |
| Social media | Employee naming or workflow clues |
Which is generally considered passive reconnaissance?
Public records are typically passive because they do not directly interact with the target service.
Correct answer: Reviewing a public certificate transparency record
Name one artifact that can reveal a target's technology stack.
Any valid source of technology intelligence is acceptable.
Correct answer: Job postings, web headers, public documents, or exposed metadata.
Prioritizing Targets
How to Rank Findings
Prioritize targets by exposure, business importance, likelihood of exploitation, and potential impact. This helps you focus time where security gains are largest.
Which factor should most influence recon priorities?
Risk-based prioritization focuses effort on the areas with the greatest potential impact.
Correct answer: Potential business impact and exposure
Why is passive recon often used first?
Passive sources are usually safer and help build context before active testing.
Correct answer: Because it can gather useful information with minimal risk of affecting the target.