Domain reconnaissance

Domain reconnaissance involves collecting information about a target-owned domain, which helps cybercriminals, ethical hackers, and penetration testers to identify whether the targeted organization has any exposed systems and network infrastructure that can be leveraged when planning a future attack. In addition, it helps ethical hackers and penetration testers to determine the external attack surface of an organization, that is, identifying all the internet-facing systems, their operating systems, open ports, and running services with the intention of discovering security vulnerabilities that can be exploited by real attackers. Domain reconnaissance can be classified as active reconnaissance if the ethical hacker or penetration tester is retrieving the domain records from a DNS server that’s owned by the target. However, with passive information gathering, the information is collected from other trusted sources that are not directly linked to the target...