Reconnaissance & OSINT

pentest1-3 named this phase Intelligence Gathering in PTES's own terms. This chapter covers what that actually means in practice: building a real picture of a target before touching it, using techniques that range from completely invisible to directly observable by the target.

Passive vs. Active Reconnaissance

Passive recon gathers information without directly interacting with the target's own systems — nothing sent reaches the target, so nothing can appear in their logs. Public records, search engines, social media, cached pages, and WHOIS lookups against a third-party registry all count as passive. Active recon means direct interaction with the target's own infrastructure — even something as simple as a DNS query sent to the target's own authoritative nameserver, or a single ping, counts as active, since it touches systems the target actually controls and could show up in their own logs.

The distinction matters because it maps directly onto risk: passive recon carries essentially zero risk of detection or disruption, while active recon — however innocuous it seems — can be logged, can trigger alerts, and some scope agreements explicitly restrict it to specific time windows or exclude particular techniques entirely.

WHOIS & DNS Enumeration

WHOIS lookups reveal registrant information, registrar, and creation/expiration dates — though privacy services now redact much of what used to be public. DNS enumeration goes further, extending net1-9's own DNS resolution hierarchy material directly into an information-gathering technique: subdomain enumeration, MX records (revealing mail infrastructure and often which third-party provider handles it), TXT records (SPF/DKIM entries and verification tokens that leak which third-party services — analytics, marketing tools, cloud providers — an organization actually uses), and NS records.

A classic (often already-fixed) misconfiguration worth checking is an open zone transfer (AXFR) — a nameserver that will hand over its entire zone file to anyone who asks, rather than only to its own designated secondary servers.

OSINT — Public Records & Social Media

• Job postings — a listing for "a Senior React Developer with AWS and PostgreSQL experience" reveals real technology-stack details for free.
• Employee enumeration via LinkedIn — relevant specifically to the Social Engineering scope category from pentest1-2.
• Public code repositories — accidentally committed credentials, internal hostnames, or revealing comments.
• Public device search engines (Shodan/Censys-style) — searching pre-existing, already-collected scan data rather than scanning the target directly, keeping this technique passive.
• Breach databases — checking whether an organization's own email addresses have appeared in known public breaches, directly relevant to bc1's own password-security material and previewing pentest1-7's credential-based exploitation.

Why Recon Quality Determines Everything Downstream

pentest1-5's scanning depends on already knowing what to scan — the IP ranges and subdomains this phase discovers. pentest1-6's vulnerability analysis depends on knowing what's actually running, using the technology-stack clues this phase surfaces. pentest1-7's exploitation sometimes depends directly on valid targets or credentials this phase turns up. A shallow recon phase doesn't just produce a smaller result on its own — it produces a shallow, incomplete attack surface map that every later phase inherits without ever knowing what was missed.

Hands-On Exercises