Basic principles of reconnaissance
Reconnaissance, or recon, is the first step of the kill chain when conducting a penetration test or an attack against a data target. It is conducted before the actual test or attack on a target network. The findings will give us an idea of where additional reconnaissance may be required or the vulnerabilities that can be capitalized upon during the exploitation phase. Reconnaissance activities are segmented on a gradient of interactivity with the target network or device.
Passive reconnaissance does not involve any malicious, direct interaction with the target network. The attacker’s source IP address and activities are not logged (for example, a Google search for the target’s email addresses will not leave a trail that the target can detect). It is difficult, if not impossible, for the target to differentiate passive reconnaissance from normal business activities.
Passive reconnaissance is divided further into the categories...
