Ethical Hacking · 5 min
Reconnaissance
Gathering information before anything is touched
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Passive vs active recon
Passive reconnaissance gathers information without directly interacting with the target — using public sources instead. Active reconnaissance involves direct interaction, like sending requests to the target's systems.
- Passive: search engines, public records, DNS history
- Active: connecting to a target's servers or apps directly
- Passive recon carries far less risk of detection or disruption
OSINT — open-source intelligence
OSINT means collecting information from publicly available sources: company websites, job postings, social media, code repositories, and public records.
- Job postings can reveal technologies in use
- Public code repos can leak configuration details
- Social media can reveal organizational structure
Loading the interactive lesson…