thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Reconnaissance

The information-gathering phase of an attack or test, identifying targets, technologies and people before exploitation.

Definition

Reconnaissance can be passive, using public sources without touching the target, or active, directly interacting with target systems. Its outputs include IP ranges, domains, employee names, email formats and technology stacks. Thorough recon is the foundation of a successful test.

Example

Discovering a company's AWS IP ranges and employee email format from public sources before scanning.

Exam tip

Recon is the first phase in PTES (intelligence gathering), CEH (footprinting) and the Cyber Kill Chain.

Related terms