Open-Source Intelligence and Passive Reconnaissance
Gathering all possible information on a target is always the most important aspect of a penetration tester’s thinking to achieve the best outcomes. In cybersecurity, gathering information through publicly available sources is often referred to as Open-Source Intelligence (OSINT). Passive reconnaissance through OSINT occurs during the first step of the kill chain when conducting a penetration test or attack against a given organization. An attacker will typically dedicate up to 75% of the overall work effort for a penetration test to reconnaissance, as it is this phase that allows the target to be defined, mapped, and explored for the vulnerabilities that will eventually lead to exploitation.
There are two types of reconnaissance:
- Passive reconnaissance (direct and indirect)
- Active reconnaissance
Passive reconnaissance is the art of collecting and analyzing openly available information, usually...
