Phase 01 · Know Before You Touch

Reconnaissance & OSINT

Before sending a single packet to the target, a good tester already knows its domains, its people, its technology stack, and the careless details it has leaked across the public internet. Reconnaissance is the quiet, patient phase where most of the engagement's leverage is actually built.

00

About this phase

Reconnaissance splits into passive (observing without interacting — no packets to the target) and active (directly probing). Passive OSINT pulls from public records, search engines, certificate logs, social media, and breach data. The goal is a rich target map: in-scope domains and IP ranges, employee names and email formats, exposed services, and the technologies in use — all before the noisy phases begin.

Recon is where engagements quietly succeed or stall. A leaked credential, a forgotten subdomain, or a published email format often does more for an attacker than any exploit.
Lessons
7 live
Phase
01 of 08
Status
Complete
01

Lessons in this phase

01.01
Passive vs Active Recon
The dividing line that matters legally and tactically — what you can learn without ever touching the target.
Live → 01.02
Footprinting: whois, DNS & Certificate Transparency
Enumerating domains, subdomains, and infrastructure from public records and CT logs.
Live → 01.03
OSINT on People & Organizations
Email formats, org charts, tech stacks, and breach data — building the human and technical target picture.
Live → 01.04
Google Dorking & Search Operators
Advanced search to surface exposed files, logins, and misconfigurations the target never meant to publish.
Live → 01.05
From Recon to Pretext
How OSINT feeds the human layer. Cross-links to the Social Engineering module.
Live → 01.06
DNS & Network Lookups at the Terminal
nslookup, dig, host, and friends. Cross-links to Terminal Network Commands.
Live → 01.07
OSINT Dorking Lab
Hands-on: chain real search operators against a simulated search engine to recover a leaked credential — then learn how to defend against it.
Lab →