Beginner · Methodology and reconnaissance · topic 10 of 35 · 18 min
Passive reconnaissance (OSINT)
Explanation
What "passive" means
Reconnaissance (recon) is gathering information about a target. Passive recon uses only public information and never sends traffic to the target's own systems. You read what is already out there: the company website, public records, search engines, social media, job ads. Because you do not touch their servers, there is little for them to log.
OSINT, open-source intelligence, is the name for building a picture from public, legally available sources. Investigators, journalists and marketers use it too; it is not unique to hacking.
What testers look for (on authorised engagements)
- Domain and DNS records: what names and mail servers the company uses (via public WHOIS and DNS lookups).
- Subdomains and technologies the company mentions publicly.
- Email address formats, from public pages (e.g. first.last@company.com).
- Job adverts, which reveal the technologies a company runs.
- Documents and metadata the company has published.
- Code or secrets accidentally left in public repositories.
A few harmless examples
A WHOIS lookup shows public registration details of a domain. A DNS lookup shows which servers a name points to. These query public directories, not the target's private systems.
whois example.com # public registration details of a domain
dig example.com ANY # public DNS records for the domain
dig +short mx example.com # the mail servers for the domainWhy defenders care, and how they respond
Detection: passive recon is very hard to detect because you are not touching the target. Defence is about reducing what is public: remove secrets from public repositories, strip metadata from documents, limit what job ads reveal, and train staff not to over-share online. A company cannot stop you reading public data, but it can make sure there is less sensitive data to read.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Passive reconnaissance (OSINT) · 1/7
Reconnaissance is gathering information about a target.
Prefer a video by a teacher? Find free videos on “passive reconnaissance OSINT basics for ethical hacking” on YouTube ↗
In real life: Scoping from the sofa
Before an authorised test of a startup, a tester spends an afternoon on OSINT: she reads the company's job ads (which mention Node.js and AWS), finds the email format from the team page, and lists the subdomains the company advertises. She has touched none of the company's servers, yet she now knows roughly what technology to expect. She notes all of it as the starting map for the active phase.
Practice (0/3 done)
Passive reconnaissance means…
Why is passive recon hard for a defender to detect?
From a staff page you learn the email format is first.last@company.com, all lowercase. Write make_email("Asha", "Verma", "company.com") returning "asha.verma@company.com".
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Active reconnaissanceMethodology and reconnaissance · same module
- Passive voice: it was made, it is doneSpoken English: Zero to Fluent · Grammar for real talk
- Enumeration: digging into servicesEnumeration and vulnerability assessment
- Post-exploitation ethics: what to do once you are inPost-exploitation ethics and reporting
- Configuring and verifying single-area OSPFComputer Networking (CCNA level) · Routing: static routes and OSPF
- Threat intelligence and indicators of compromiseCyber Security: from zero to SOC analyst · Threat intelligence and frameworks
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
WHOIS shows…
Answer: Public registration details of a domain
WHOIS returns public domain registration data.
The best defence against OSINT is to…
Answer: Reduce what sensitive information is public and train staff
You cannot stop people reading public data; publish less of it.
Which of these is still off-limits during passive recon?
Answer: Using leaked passwords to log in
Using leaked credentials to access accounts is account access, not passive recon, and is illegal.
dig +short mx example.com returns…
Answer: The domain's mail servers
It queries public DNS for the mail (MX) records.
A good defence against recon fingerprinting is to…Related
Answer: Hide version banners and return plain error pages
Revealing less gives attackers less to work with.
Make it passive: "Someone cleans the office every morning."Related
Answer: The office is cleaned every morning.
Present passive: is + past participle (cleaned). "By someone" is not needed.
The rules of engagement should be…Related
Answer: Written and signed before testing starts
RoE are written and signed before any testing begins.
Enumeration is noisier than scanning because it…Related
Answer: Sends many requests and produces many 404s
The volume of requests and error responses stands out in logs.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 1 more topic in “Methodology and reconnaissance” before its exam: Active reconnaissance.
- Module 3 exam: methodology and recon · 12 questions · 18 min, without help. 3 topics of this module still to finish first.
- Then the next module, Scanning with nmap. 35 topics left in the course before the final exam.