Everybody and welcome to the next video.
So in this we want to be talking about reconnaissance.
Now what is reconnaissance.
This is also called recon and you're going to find a lot of variations of the name such as information
gathering.
It either either word is fine.
We're gonna be looking at gathering information about a specific target.
Now what I want to stress is that this is a very important step when going through the pen testing process
being able to understand what information is relevant and what may be relevant and what is not relevant
is important as well as gathering as much information as you can.
You never know really what you're going to need to make an attack work and it could be something just
as small as some employee posting on a we're on a different form about a specific topic using their
corporate address to us to layer down phishing attempts or whether it's gaining information about a
particular service that might be running in its version to ban or grabbing.
So there's going to be a lot of important topics we're gonna go over.
But it's important to note down everything you find in some way shape or form.
If you think it may be relevant or there's something about it that doesn't seem regular to normal or
even some things you might see as normal like job postings you're going to want to note this down.
You never know when it's going to be used so there's two types of reconnaissance.
There's passive and active now passive is you're not touching the target directly such as you're not
doing port scans you're not trying to manipulate the site in any way you're using stuff like Google
showed on net craft or any other third party elements for us to be able to let them touch the site and
us not leave a footprint.
The key is to note not leave a footprint that can be it can be seen as an attacker.
So we don't want to throw off any flags or anything we should just look like a normal user just anybody
around the world trying to use the service.
We shouldn't be poking at the systems directly as an example now active reconnaissance is a whole different
ballgame.
This is where we're going to be interfacing with the target directly we're gonna be running port scans
we're going to be better grabbing we're going to be connecting to services we're going to be trying
to log into things as an example possibly we're going to be looking at getting away from being detected
by the blue team.
Now in some engagements or assessments you might not need to do this in some cases you might not care
but in some cases you do it might be a requirement based on the scoping that you guys have already done.
So this is the case you need to make sure you pull it back just a little bit and keep into consideration
throwing a giant port scan across the whole network segment is a good way to get the blue team to notice
what's happening.
But what I want you guys to take away from this video is understanding difference between passive and
active.
Are you physically touching the site so browsing the site is a gray line if you're just browsing the
site and reading some text around it you're not going to weird directories but you're just reading the
information and navigating the site maybe looking at the source that's available that's fine.
That can be labeled as passive or active depending on what you're doing in this course.
I'm going to treat it as active because you're actually touching the site itself but it's important
to understand the difference between the two because you want to do your passive reconnaissance first
because that helps narrow down your active reconnaissance because active can get pretty deep pretty
quickly and you want to make sure that you have as much information about where you can start your targeting
as possible.