Reconnaissance and Information Gathering: The First Phase of Every Pentest

Understanding reconnaissance information gathering is the foundation of this guide. Below we break it down step by step so you can act with confidence.

Reconnaissance is the first and most important phase of any penetration test. Before you attack anything, you need to understand what you are attacking — what technologies are in use, what is exposed to the internet, who works there, and where the potential entry points are.

The more information you gather, the better your attacks will be. Skilled pentesters spend 50-70% of their time on reconnaissance. Amateurs jump straight to exploitation and miss most of the attack surface.

Reconnaissance Information Gathering: Passive reconnaissance: gathering without touching the target

Passive recon collects information without sending any traffic to the target. The target has no idea you are looking. This is legal for any public information.

# WHOIS — domain registration information
$ whois example.com
Registrar: Example Registrar Inc.
Creation Date: 1995-08-14
Name Server: ns1.example.com

# DNS records — all public DNS entries
$ dig example.com ANY +noall +answer
example.com. 300 IN A     93.184.216.34
example.com. 300 IN MX    10 mail.example.com.
example.com. 300 IN TXT   "v=spf1 include:_spf.google.com ~all"

# Reverse DNS — what domain points to this IP?
$ dig -x 93.184.216.34 +short

# Certificate Transparency logs — find subdomains
$ curl -s "https://crt.sh/?q=%25.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u
www.example.com
mail.example.com
staging.example.com    # ← interesting!
dev.example.com        # ← very interesting!

# Wayback Machine — historical snapshots
# https://web.archive.org/web/*/example.com
# Old pages may reveal removed admin panels or test pages

Google dorking: advanced search for security

Google indexes more than you think. Google dorking uses advanced search operators to find sensitive information that should not be public:

# Find login pages:
site:example.com inurl:login OR inurl:admin OR inurl:signin

# Find exposed files:
site:example.com filetype:pdf OR filetype:xlsx OR filetype:doc
site:example.com filetype:sql OR filetype:bak OR filetype:conf

# Find directory listings (misconfigured servers):
intitle:"index of" site:example.com

# Find error messages (reveal tech stack):
site:example.com "fatal error" OR "mysql_connect" OR "stack trace"

# Find exposed .env files (credentials!):
site:example.com filetype:env OR inurl:.env

# Find WordPress admin panels:
site:example.com inurl:wp-admin OR inurl:wp-login

# Find subdomains Google knows about:
site:*.example.com -www

# IMPORTANT: Only use Google dorking on targets you have
# permission to test. Finding is not exploiting, but
# accessing exposed data without permission is illegal.

Active reconnaissance: subdomain and service enumeration

Active recon sends traffic to the target. The target's logs may record your activity. This should only be done with explicit authorization.

# Subfinder — fast passive subdomain discovery
$ subfinder -d example.com -silent
www.example.com
mail.example.com
api.example.com
staging.example.com

# Amass — comprehensive enumeration (slower, deeper)
$ amass enum -d example.com -passive

# DNS brute force with common subdomain names:
$ cat /usr/share/wordlists/subdomains-top1mil-5000.txt | \
  while read sub; do
    host "$sub.example.com" 2>/dev/null | \
    grep "has address" && echo "[FOUND] $sub.example.com"
  done

# Combine results and resolve IPs:
$ cat all-subdomains.txt | sort -u | \
  while read d; do
    ip=$(dig +short $d | head -1)
    echo "$d → $ip"
  done | tee resolved.txt

# Check which subdomains are alive:
$ httpx -l all-subdomains.txt -silent -status-code
https://www.example.com [200]
https://api.example.com [200]
https://staging.example.com [403]  # ← might be interesting

Building a target profile

All reconnaissance data should be organized into a target profile:

• Domain info — registrar, nameservers, creation date, contacts
• Subdomains — all discovered subdomains with IPs and HTTP status codes
• Technology stack — web server, CMS, frameworks, languages (use Wappalyzer, WhatWeb)
• Email addresses — found via LinkedIn, GitHub, Hunter.io, theHarvester
• Open ports — from Nmap scans (next lesson)
• Potential entry points — login pages, API endpoints, file uploads, outdated software

# theHarvester — emails, subdomains, hosts from public sources
$ theHarvester -d example.com -b google,bing,linkedin,crtsh

# Output:
# Emails found:
#   [email protected]
#   [email protected]
#   [email protected]
#
# Subdomains found:
#   www.example.com - 93.184.216.34
#   mail.example.com - 93.184.216.35
#   vpn.example.com - 93.184.216.40
#
# Now you have email format (first.last@) and potential
# targets for phishing simulation

When evaluating reconnaissance information gathering, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Frequently asked questions

Is passive reconnaissance legal?

Generally yes — you are accessing publicly available information (WHOIS, DNS, Google, certificate logs). However, automated mass data collection may violate terms of service. Active reconnaissance (sending packets to a target) requires explicit authorization.

How do I organize all the information I gather?

Use a note-taking tool like CherryTree, Notion, or Obsidian organized by target. Many professionals use the PTES (Penetration Testing Execution Standard) format. Always timestamp your findings — the target's infrastructure changes over time.