What is Reconnaissance?

Reconnaissance is the information-gathering phase where an ethical hacker learns as much as possible about a target before any active testing begins.

Why Reconnaissance Comes First

Every successful engagement starts with understanding the target: its domains, technologies, employees, and public footprint. This groundwork shapes every decision made later in the test.

Passive vs Active Reconnaissance

Passive reconnaissance gathers information without directly interacting with the target, such as researching public records, while active reconnaissance involves direct contact, like pinging a server, and carries more risk of detection.

What Information Is Collected

Testers typically look for domain and subdomain names, IP ranges, employee details, technologies in use, and any publicly exposed files or services that could reveal a weakness.

Setting Up for the Next Phase

The output of reconnaissance directly feeds into scanning and vulnerability analysis, making it the foundation the rest of the penetration test is built on.