thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Passive Reconnaissance

Gathering information about a target without directly interacting with its systems.

Definition

Passive techniques use third-party sources such as search engines, WHOIS, DNS records held by public resolvers, certificate transparency logs, social media and breach data. Because no packets reach the target, it is very hard to detect. It is generally permissible before formal authorization of active testing, though RoE may still govern it.

Example

Searching crt.sh for certificates issued to *.example.com to find subdomains.

Exam tip

If the question stresses that the target must not detect the activity, choose passive recon.

Related terms