By Tech Corsair
There is a very thin line between "penetration tester performing reconnaissance" and "person who knows far too much about a company they've never visited." The difference? A signed contract, a clearly defined scope of work, and the quiet confidence that comes from knowing your invoices will actually get paid.
Reconnaissance is the first -- and arguably most important -- phase of any penetration test. It is also, if we are being honest, the part that makes security professionals sound the most unhinged at dinner parties. "Oh, I spent all day finding out which mail server a company uses, what version of Apache they're running, and that their CFO's dog is called Bernard." Normal Tuesday, really.
This article covers both passive and active reconnaissance: the art of learning everything about a target without touching it, and then the slightly less subtle art of poking it with sticks to see what happens.
Mandatory disclaimer: Everything described here must only be performed against systems you have explicit, written authorisation to test. Unauthorised reconnaissance against systems you do not own is illegal in most jurisdictions. Get the contract signed first. Then stalk professionally.
Passive Reconnaissance: Learning Everything Without Leaving Fingerprints
Passive recon is the digital equivalent of reading someone's public social media profile and drawing conclusions. The target has no idea you're looking, because you never interact with their systems directly. All the information comes from publicly available sources -- a fact that should terrify most organisations.
Google Dorking: The Search Engine as a Weapon
Google indexes things it probably shouldn't. Google dorking (also called Google hacking) uses advanced search operators to find information that organisations have accidentally left exposed on the public internet. It is not a vulnerability in Google -- it is a vulnerability in people who put sensitive files on web servers and assumed nobody would look.
Some classics:
site:target.com filetype:pdf
site:target.com filetype:xlsx
site:target.com filetype:docxThese find documents that may contain metadata -- author names, internal usernames, software versions, directory paths. Every PDF has a story to tell, and most of them are confessions.
site:target.com inurl:admin
site:target.com intitle:"index of" "parent directory"
site:target.com ext:sql | ext:db | ext:logThe first finds admin panels. The second finds open directory listings -- essentially a file browser that someone forgot to lock. The third hunts for database dumps and log files that have been left on web servers like forgotten shopping bags.
site:target.com intext:"password" filetype:log
site:target.com ext:env | ext:cfg | ext:confFinding configuration files and logs containing passwords in cleartext. It happens more often than anyone in the industry would like to admit.
The Google Hacking Database (GHDB) maintained by Offensive Security catalogues thousands of these dorks, sorted by category. It reads like a horror novel for system administrators.
DNS Enumeration: Reading the Phone Book
DNS is the phone book of the internet, and like a phone book, it tells you far more than people realise. DNS enumeration reveals subdomains, mail servers, name servers, and sometimes internal hostnames that were never meant to see daylight.
# WHOIS lookup -- who registered the domain, when, and with what registrar
whois target.com
# DNS record lookup -- A, MX, NS, TXT records
dig target.com ANY
dig target.com MX
dig target.com TXT
# Reverse DNS lookup
dig -x 203.0.113.50
# Zone transfer attempt (usually blocked, but always worth trying)
dig axfr target.com @ns1.target.com
# Subdomain enumeration with a wordlist
dnsenum target.com
fierce --domain target.comA successful DNS zone transfer is the jackpot -- it dumps the entire DNS zone file, revealing every subdomain, internal hostname, and IP mapping. Most organisations have disabled this for external queries, but "most" is not "all," and the ones who haven't tend to be the same ones running Windows Server 2008 in production.
Tools like DNSDumpster, SecurityTrails, and crt.sh (Certificate Transparency logs) allow subdomain discovery without sending a single packet to the target. Certificate Transparency is particularly useful -- every SSL/TLS certificate issued is logged publicly, so searching %.target.com on crt.sh often reveals development, staging, and internal subdomains that the target forgot existed.
# Query Certificate Transparency logs
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq '.[].name_value' | sort -uShodan and Censys: The Search Engines That Index Everything Else
If Google indexes web pages, Shodan indexes everything connected to the internet. Web servers, IoT devices, SCADA systems, webcams, printers, and that one developer's Raspberry Pi that has been running an unpatched SSH server since 2019.
# Shodan queries
hostname:target.com
org:"Target Company Ltd"
ssl.cert.subject.cn:target.com
net:203.0.113.0/24Shodan reveals open ports, service versions, SSL certificate details, and default credentials on devices that should never have been internet-facing. Censys provides similar capabilities with a focus on certificate and host data.
The truly terrifying part is that none of this requires interacting with the target. Shodan has already done the scanning. The penetration tester is simply reading the results -- like finding out your front door has been unlocked by checking a public database of unlocked front doors.
Social Media Intelligence: LinkedIn as an Attack Surface
LinkedIn is the greatest OSINT tool ever created, and it was not designed to be one. A company's LinkedIn presence reveals:
- Employee names and job titles -- useful for spear phishing and identifying IT staff, sysadmins, and executives
- Technology stack -- job postings for "Senior Kubernetes Engineer" or "Splunk Administrator" tell the red team exactly what the target is running
- Organisational structure -- who reports to whom, which teams exist, how large the IT department is
- Email format -- if three employees are listed as j.smith, a.jones, and b.wilson, the naming convention is first initial dot surname
Metadata extraction from publicly available documents adds another layer. Tools like exiftool pull author names, software versions, GPS coordinates (from images), internal file paths, and printer names from PDFs, Office documents, and images.
# Extract metadata from a downloaded document
exiftool target-annual-report.pdf
# Bulk extraction
exiftool -r -ext pdf -ext docx /path/to/downloaded/docs/A single PDF can reveal an internal username, the version of Microsoft Office installed, and the hostname of the machine it was created on. Attackers can use this to craft convincing phishing emails, guess usernames, and identify software to target. It is remarkable how much intelligence leaks through a document that was meant to be a quarterly earnings summary.
Other OSINT tools worth mentioning: theHarvester for email and subdomain collection, Recon-ng as a full OSINT framework, Maltego for relationship mapping, and SpiderFoot for automated OSINT collection across dozens of data sources.
# theHarvester -- collect emails, subdomains, IPs from public sources
theHarvester -d target.com -b google,bing,linkedin,dnsdumpster -l 500Active Reconnaissance: Now You're Touching Things
Active reconnaissance involves directly interacting with the target's systems. Unlike passive recon, this will leave logs, trigger IDS alerts, and generally announce that someone is having a look around. This is where the authorisation paperwork becomes non-negotiable.
Port Scanning with Nmap: Knocking on Every Door
Nmap (Network Mapper) is the Swiss Army knife of network reconnaissance. It has been the go-to port scanner since 1997, and it remains indispensable because nothing else does quite so many things quite so well.
# Host discovery -- find live hosts on a network (ping sweep)
nmap -sn 192.168.1.0/24
# Basic TCP SYN scan of common ports
nmap -sS 10.10.10.50
# Full port scan with service version detection and default scripts
nmap -sV -sC -p- 10.10.10.50
# Aggressive scan -- OS detection, version detection, scripts, traceroute
nmap -A -p- 10.10.10.50
# UDP scan (slow, but important -- DNS, SNMP, TFTP live here)
nmap -sU --top-ports 100 10.10.10.50
# Scan specific ports with increased verbosity and output to all formats
nmap -sV -sC -p 21,22,80,443,445,3389,8080 -v -oA scan_results 10.10.10.50A few notes on these:
-sS(SYN scan) is the default and stealthiest TCP scan -- it sends a SYN, waits for SYN-ACK, then sends RST instead of completing the handshake. Technically, no full TCP connection is ever established. In practice, every half-decent IDS will still notice.-sVprobes open ports to determine service version. The difference between "port 80 is open" and "port 80 is running Apache 2.4.49" is the difference between a finding and an exploit.-sCruns Nmap's default scripts (NSE -- Nmap Scripting Engine), which perform basic enumeration like grabbing HTTP titles, checking for anonymous FTP, and testing SMB shares.-p-scans all 65,535 TCP ports. Without this flag, Nmap only scans the top 1,000. Many interesting services hide on high ports specifically to avoid casual scans.
The Nmap Scripting Engine deserves special mention. It contains hundreds of scripts for everything from brute-forcing credentials to detecting specific vulnerabilities:
# Check for SMB vulnerabilities (EternalBlue, etc.)
nmap --script smb-vuln* -p 445 10.10.10.50
# Enumerate HTTP methods
nmap --script http-methods -p 80,443 10.10.10.50
# Brute-force DNS subdomains
nmap --script dns-brute target.comService Enumeration: What's Behind Door Number 443?
Once open ports are identified, the next step is service enumeration -- determining exactly what is running, what version it is, and whether it has any known vulnerabilities or misconfigurations.
Banner grabbing is the simplest form. Many services announce themselves when a connection is established:
# Manual banner grab with Netcat
nc -nv 10.10.10.50 22
# Output: SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2
# Banner grab with Nmap
nmap -sV --script banner -p 21,22,25,80,443 10.10.10.50
# HTTP header inspection
curl -I https://target.comService-specific enumeration tools dig deeper:
# SMB enumeration (shares, users, policies)
enum4linux -a 10.10.10.50
smbclient -L //10.10.10.50 -N
# SNMP enumeration (if community strings are default)
snmpwalk -v2c -c public 10.10.10.50
# Web directory brute-forcing
gobuster dir -u http://10.10.10.50 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
# WordPress enumeration
wpscan --url http://target.com --enumerate u,p,tEach service has its own enumeration methodology. SMB might reveal file shares with sensitive data. SNMP with default community strings can leak the entire network configuration. A WordPress site with outdated plugins is practically an invitation.
Vulnerability Scanning: Automated "Is This Broken?"
Vulnerability scanners automate the process of checking discovered services against databases of known vulnerabilities. They are loud, thorough, and about as subtle as a brass band in a library.
- Nessus (Tenable) -- the industry standard for vulnerability scanning. Comprehensive plugin library, compliance checks, and the kind of reports that make management take notice. The professional version is commercial; Nessus Essentials covers up to 16 IPs for free.
- OpenVAS (Greenbone) -- the open-source alternative. Fully capable, regularly updated, and free. The setup process builds character.
- Nikto -- specifically for web server scanning. Fast, noisy, and effective at finding misconfigurations, outdated software, and dangerous default files.
# Nikto web server scan
nikto -h http://10.10.10.50
# OpenVAS command-line scan (after setup)
gvm-cli socket --socketpath /run/gvmd/gvmd.sock --xml "<create_target>..."Vulnerability scanners are not a replacement for manual testing. They find known vulnerabilities in known software -- they will not find business logic flaws, chained attack paths, or the fact that the CEO's password is the company name followed by the current year. But they provide an excellent foundation for the exploitation phase.
Putting It All Together: The Recon Workflow
A methodical reconnaissance phase follows a logical progression:
- Define scope -- what domains, IP ranges, and systems are in scope? What is explicitly out of scope?
- Passive OSINT -- Google dorking, DNS enumeration, Shodan, certificate transparency, social media, metadata extraction. Build a picture without touching the target.
- Active host discovery -- ping sweeps and ARP scans to identify live hosts within the authorised IP ranges.
- Port scanning -- full TCP and targeted UDP scans against discovered hosts.
- Service enumeration -- version detection, banner grabbing, service-specific enumeration.
- Vulnerability scanning -- automated scanning to identify known vulnerabilities.
- Documentation -- every finding recorded, every scan output saved. The report writes itself if the notes are good.
The output of reconnaissance feeds directly into the exploitation phase. Every open port is a potential entry point. Every outdated service is a candidate for a known exploit. Every leaked username is a target for password attacks. Every piece of technology identified narrows the search for applicable vulnerabilities.
Conclusion: Know Thy Target
Reconnaissance is where engagements are won or lost. A thorough recon phase means the penetration tester arrives at exploitation with a comprehensive map of the target's attack surface, a list of potential vulnerabilities, and enough understanding of the environment to choose the right attack paths. A sloppy recon phase means firing Metasploit at random IP addresses and hoping for the best -- which is neither professional nor effective.
The uncomfortable truth for defenders is that most of the information gathered during passive reconnaissance was put there voluntarily. Job postings, public documents, DNS records, SSL certificates, social media profiles -- organisations publish an extraordinary amount of useful intelligence without ever considering how it might be weaponised.
The skill set is, as noted, essentially professional stalking. The contract just makes it legal, ethical, and billable.
Now go forth and enumerate -- responsibly, and with a signed scope of work in your back pocket.
This article is part of the Offensive Security series on techcorsair.co.uk. All techniques described are for authorised testing and educational purposes only.
