Information Gathering Methodology

• Information gathering is the first step on any penetration test, basically involves gathering or collecting information about an individual, company, website or system.Information gathering types:

  • Passive information gathering - involves gathering information without engaging with the target.
  • Active information gathering - involves gathering information engaging with the target system.

Active Information Gathering

• Discovering open ports on target systems.
• Learning about the infrastructure ot a target/network/organization.
• Enumerating information from target systems.

Passive Information Gathering

• Identifying IP addresses & DNS information.
• Identifying Domain names and Domain ownership information.
• Identifying e-mail addresses and social media profiles.
• Identifying web technologies being used in target sites.
• Identifying subdomains.

Target Scoping

In this part is decided which systems, networks, applications, services are allowed to test.

I don't test everything that i find, I just test only what have been authorized.

Common Types of Target

Domain-based Targets

• domain.com
• localdomain.local

A domain-based scope may include:

• Primary domain
• Subdomains
  • mail.domain.com
  • admin.domain.com
  • sftp.domain.com

IP-Based Targets

• A single IP address: 192.168.1.27
• A network range: 192.168.1.0/24

Application-Based Targets

Here the focus is only the application

• A web Application
• A Login/portal or API endpoint

Scope

Assest you are allowed to:

• Collecting information from
• Scanning
• Enumerating

Out-of-Scope

Assets you must not interact with.

Example:

• Third-party Services
• External Domains not within the scope.
• Systems owned by another organization.

Why it matters?

Reconaissance is about collecting useful information, not collecting all information.

• Without proper scoping

  • Scan of irrelevants host
  • Miss the target
  • Results become noisy and confusing

• Scope keeps your reconaissance

  • Focused
  • Efficient
  • Relevant to later stages.

Passive Reconnaissance

As mentioned early passive reconnaissance involves collecting information without interacting with the target systems.

• Key characteristics :

  • No direct connections to the targets/servers
  • Low risk detection
  • We start by here

• Examples of passive recon data

  • Domain registration information
  • DNS Records
  • Public Website Content
  • Search engine results
  • Public e-mail addresses

Active Reconnaissance

Involves interacting with the target.

• Key characteristics :

  • Send traffics to the target

• Examples of active recon data

  • Live host
  • Open ports
  • Running services
  • Network responses

What information are we trying to collect?

The goal is to build a map of the target.

• Domains and subdomains
• IP adresses
• Hosting infrastructure
• Technologies and services
• Open ports
• Publicy exposed information

Recon Mapping Flow

flowchart TD
    A[Define Target Scope] --> B[Passive Reconnaissance]
    B --> C[Active Reconnaissance]
    B --> D[Domains & Subdomains]

    C --> E[Host Discovery]
    C --> F[Organize Findings]

    E --> G[Port Scanning]
    G --> H[Basic Service Identification]
    H --> I[DNS Zone Transfer Testing]

    F --> J[Proceed to Enumeration & Exploitation]

    D --> K[DNS Records]
    K --> L[Whois Data]
    L --> M[Website Footprinting]
    M --> N["OSINT: Search Engines, Emails, Breach Awareness"]
    N --> O[Technology Fingerprinting]

    subgraph Active Reconnaissance
        E
        G
        H
        I
    end

    subgraph Passive Reconnaissance
        D
        K
        L
        M
        N
        O
    end

Recon Strategy

Four-step strategy during eveyr engagement:

Step 1: Define the target

• Identify the domain, IP address, or network range
• Confirm what is in scope

Step 2: Perform Passive Reconnaissance

• Gather public information
• Identify potential attack surfaces
• Build initial understanding of the target

Step 3: Perform Active Reconnaissance

• Discover live host
• Identify open ports
• Detect exposed services

Step 4: Document and organize your findings

• Records domains, IPs, and ports
• Prepare information for enumeration
• Avoid repeating work later

Avoid

• Enumerating without defining scope
• Skipping passive recon
• Scanning everything instead of relevant targets.
• Not documenting results
• Trusting tools output without verifiying

Takeaways

• Target scoping defines what are you allowed to test.
• Passive recon comes before active recon
• recon is about collecting meaningful data
• Be structured