Basic principles of reconnaissance.
Reconnaissance or recon is the first step of the kill train when conducting a penetration test or an
attack against a data target.
It is conducted before the actual test or attacked on a target network.
The findings will give us an idea of where additional reconnaissance may be required or the vulnerabilities
that can be capitalized upon during the exploitation phase.
Reconnaissance activities are segmented on a gradient of interactivity with a target network or device,
so passive reconnaissance does not involve any malicious direct interaction with the target network.
So the trackers, source IP address and activities are not logged.
For example, a Google search for the target's email addresses will not leave a trail that the target
can detect.
So it's difficult, if not impossible, for the target to differentiate the passive reconnaissance from
a normal business activities.
So passive reconnaissance is divided into two categories direct or indirect.
So direct passive reconnaissance involves the normal interactions that occur when an attacker expectedly
interacts with the target.
So, for example, an attacker will look on the corporate website with various pages and download documents
for further study.
So these interactions are expected user activities and are rarely detected as a prelude to an attack
on the target.
In indirect passive reconnaissance, there will be absolutely no interaction with the target organization.
In contrast, active reconnaissance involves direct queries or other interactions.
For example, port scanning of the target network that can trigger system alarms or low the target to
capture the attacker's IP address and activities.
So this information could be used, identify and arrest an attacker or use during legal proceedings.
So therefore, passive reconnaissance carries a lot less risk, but its active counterpart has its limitations.
Penetration testers or attackers generally follow a process of structured information gathering, moving
from a broad scope.
So for example, the business and or regulatory environments to something much more specific like user
account data.
So to be effective, testers should know exactly what they are looking for and how the data will be
used before collection starts.
So using passive reconnaissance and limiting the amount of data collected minimises the risk of being
detected by the target.