Gathering all possible information on a target is always the most important aspect of a penetration
testers thinking to achieve the best outcomes.
In cybersecurity, Gathering information through publicly available sources is often referred to as
open source intelligence or sins.
So passive reconnaissance toward Osint occurs during the first step of the kill chain.
When conducting a penetration test or attack against a given organization, an attacker will typically
dedicate up to 75% of the overall work effort for a penetration test to reconnaissance, as it is the
face that allows the target to be defined, mapped and explored for the vulnerabilities that will eventually
lead to exploitation.
There are two types of reconnaissance, passive reconnaissance, which means direct and indirect.
And we also have active reconnaissance.
Passive reconnaissance is the art of collecting and analyzing openly available information, usually
from the target itself or public sources online.
On accessing this information, the tester or attacker does not interact with the target in an unusual
manner.
Request and activities will be not logged and so will not be traced directly to the tester.
Therefore, passive reconnaissance is conducted first to minimize the red contact that may signal an
impending attack or to identify the attacker.
In the section, you will learn the principles and practices of passive reconnaissance and open source
intelligence, which include basic principles of reconnaissance, open source intelligence, online
resources, and dark web search.
We will also obtain a user information.
We will also profile users for password lists, and we will also use the social media to extract password
word list.
Active reconnaissance, which involves direct interaction with a target, will be covered in next lecture
of our course.
My name is Typhoon and in next lectures I'm waiting you.