CoreQ Academy2.1 Given a scenario, apply information gathering techniques.
Reconnaissance builds the map of the target. Passive techniques gather information without touching the target; active techniques interact with it and can be detected.
Approach
- Active and passive reconnaissance
- Passive uses public sources without contacting target systems; active probes the target (scans, banner grabs).
Open-source intelligence (OSINT)
- Social media
- Employee names, roles, technologies and photos of badges or desks.
- Job boards
- Job ads reveal technologies in use (e.g. "experience with Palo Alto and Okta").
- Scan code repositories
- Public repos may leak credentials, internal hostnames or code.
- Domain Name System (DNS)
- Public DNS reveals hosts, mail servers and services.
- DNS lookups
- Resolving names to addresses and querying record types (A, MX, TXT, NS).
- Reverse DNS lookups
- Resolving IP addresses back to names to discover hosts.
- Cached pages
- Old versions of pages in search or archive caches can show removed content.
- Cryptographic flaws
- Public certificate and TLS details can reveal weak configurations or internal names.
- Password dumps
- Previously breached credentials associated with the target domain, used (within scope) to assess password reuse risk.
Network and protocol reconnaissance
- Network reconnaissance
- Mapping live hosts, ranges and network paths.
- Protocol scanning
- Checking which protocols and ports respond.
- Transmission Control Protocol (TCP)/User Datagram Protocol (UDP) scanning
- Probing TCP and UDP ports; UDP scanning is slower and less reliable because closed ports often do not reply.
- Certificate transparency logs
- Public logs of issued TLS certificates that reveal subdomains.
- Information disclosure
- Verbose errors, headers, comments or files that leak internal details.
- Search engine analysis/enumeration
- Using search operators to find exposed files, login pages and subdomains.
- Network sniffing
- Capturing traffic on a network you are authorised to access to learn hosts and protocols.
- Internet of Things (IoT) and operational technology (OT) protocols
- Identifying protocols such as MQTT, Modbus, BACnet and DNP3; probe OT carefully because devices can be fragile.
- Banner grabbing
- Reading service banners to identify software and versions.
- Hypertext Markup Language (HTML) scraping
- Extracting names, emails, links and comments from web pages.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.1 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.