The quality of your reconnaissance determines the quality of your security assessment. Experienced penetration testers spend more time on reconnaissance than on any other phase — because the attack surface you understand is the attack surface you can test, and the attack surface you miss is the attack surface that remains vulnerable. “I found an IDOR” is a result of good recon. “I found nothing” is usually a result of poor recon.
This passive vs active reconnaissance guide covers the complete reconnaissance methodology used by professional penetration testers and bug bounty hunters — the distinction between passive and active approaches, the right tools for each phase, the exact command sequences to run, and how to organise everything you find into an attack surface map that guides your testing.
The Core Distinction — Passive vs Active
In every professional engagement, passive reconnaissance comes first — always. You exhaust publicly available information before sending a single packet to the target. This gives you a complete picture of the attack surface before any active scanning could trigger an alert or start a clock on an engagement window. See also: our foundational passive vs active recon article and the full Footprinting and Reconnaissance Tutorial.
Passive Reconnaissance — OSINT Tools & Techniques
whois target.com # Registrar, dates, registrant contact, nameservers
# Or use our free online tool: securityelites.com/tools/whois-lookup-tool/
# ─── DNS — Record Enumeration ────────────────────────────────
dig target.com ANY # All DNS records
dig target.com MX # Mail servers → email hosting provider
dig target.com TXT # SPF, DKIM, verification records → tech stack
host -t ns target.com # Nameservers
# ─── theHarvester — Email & Subdomain OSINT ─────────────────
theHarvester -d target.com -l 200 -b google,bing,linkedin
# ─── Certificate Transparency — Passive Subdomain Discovery ─
curl -s “https://crt.sh/?q=%.target.com&output=json” | python3 -m json.tool | grep “name_value”
# ─── Google Dorks — Passive Information Discovery ────────────
site:target.com filetype:pdf # Indexed PDF documents
site:target.com inurl:admin # Admin panels
site:github.com “target.com” password # Exposed credentials on GitHub
# Full Google Dorks reference: securityelites.com/day-9-google-dorking-osint/
Full tutorials for each passive recon tool: Day 1: WHOIS Tutorial | Day 9: Google Dorking & OSINT | Information Gathering Tools in Kali Linux
Active Reconnaissance — Nmap, Subfinder & Enumeration
Active reconnaissance directly probes the target — generating traffic, triggering possible IDS rules, and leaving traces in server logs. This phase requires explicit written authorisation. See the Hacker Recon Checklist to confirm you are ready before starting active scanning.
Complete Recon Tool Matrix — Passive vs Active
| Tool | Type | Purpose | Authorisation? |
|---|---|---|---|
| WHOIS | PASSIVE | Domain registrar, contact info, dates | Not needed |
| theHarvester | PASSIVE | Emails, subdomains from search engines | Not needed |
| Google Dorks | PASSIVE | Exposed files, admin panels, login pages | Not needed |
| crt.sh | PASSIVE | Certificate transparency → subdomain discovery | Not needed |
| Shodan | PASSIVE | Internet-exposed devices, banners, services | Not needed |
| Nmap | ACTIVE | Port scan, service versions, OS detection | Required |
| Subfinder (active) | ACTIVE | DNS brute force subdomain enumeration | Required |
| Gobuster/ffuf | ACTIVE | Directory/endpoint discovery via brute force | Required |
| Nikto | ACTIVE | Web server misconfigurations, outdated software | Required |
The Professional Recon Workflow — In Order
Organising Your Recon Findings
Unorganised recon produces the same results as no recon. Professional hunters use a structured notes system — Obsidian or Notion — with a consistent template per target. The minimal structure to maintain:
# ─────────────────────────────────────────────
## PASSIVE RECON
– Registrar: GoDaddy | Expires: 2027-03-15
– Nameservers: ns1.cloudflare.com, ns2.cloudflare.com
– Subdomains found (crt.sh): dev.target.com, staging.target.com, api.target.com
– Emails (theHarvester): john@target.com, devops@target.com
– Shodan: 3 IPs exposed, Apache 2.4.51 (CVE check needed)
## ACTIVE RECON (IN-SCOPE ONLY)
– Nmap results: saved to target_scan.xml
– Open ports: 22 (SSH 8.2), 80 (redirect), 443 (nginx 1.18), 8443 (Tomcat 9)
– Directories found: /admin (200), /api/v1/ (200), /backup/ (403)
## PRIORITY TARGETS
1. staging.target.com — no auth on /admin — HIGH VALUE
2. api.target.com/v1/ — no rate limiting seen — test IDOR
3. Tomcat 9 on 8443 — check for default credentials
Full information gathering series with hands-on labs: Information Gathering Tools in Kali Linux | Footprinting & Reconnaissance category
Frequently Asked Questions – Passive vs Active Reconnaissance
Hacker Recon Checklist: 10-Step Ethical Hacking Recon Guide
SecurityElites — Web Application Penetration Testing Methodology 2026
OSINT framework for reconnaissance — Complete Reference →
MITRE ATT&CK reconnaissance techniques →
OWASP testing guide for reconnaissance phase →
The best findings I have made in authorised assessments came from recon — not from exploitation. A staging server that was indexed by Google. A GitHub repository with hardcoded API keys. A certificate transparency log showing a subdomain that did not appear in any other enumeration. Recon that looks boring often finds things that automated tools miss entirely because the information is in plain sight and nobody bothered to look.
