Reconnaissance is the first working phase of a penetration test, the systematic collection of information about a target before any exploit is attempted. It sits between scoping and active vulnerability scanning, turning a client's name or domain into a concrete inventory of subdomains, exposed services, technologies, and employees that decide where the rest of the engagement even starts. Most of this phase is passive, pulling from WHOIS records, certificate transparency logs, search engines, and internet-scanning databases like Shodan and Censys without a single packet reaching the target, which keeps it both legally low-risk and invisible to the target's defenders. The practical skill is not any one tool but cross-referencing: the same subdomain discovered by certificate transparency, DNS enumeration, and a search-engine dork corroborates itself, while a single unconfirmed hit is noise. Every technique below still operates inside a signed scope and rules of engagement — recon that drifts outside authorized targets is the fastest way to turn a legitimate assessment into a legal problem.
What This Cheat Sheet Covers
This topic spans 13 focused tables and 87 indexed concepts, 84 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Scoping, Authorization, and Rules of Engagement
Before a single lookup runs, a penetration test needs a defined boundary and legal cover; this table is the paperwork and legal reality that recon operates inside, not a technique in itself.
| Concept | Example | Description | |
|---|---|---|---|
A signed SOW listing IP ranges: 203.0.113.0/24, domains: *.example.com, and defined start/end dates | • The legal document authorizing testing • recon on a target should never begin before this is signed. | ||
Explicitly listing which DNS servers, mail servers, and firewalls are owned by the client vs. a third party | • Defines exactly what may be tested • anything outside it, including infrastructure the client doesn't directly own, is off-limits | ||
"Testing window: weekdays 09:00-17:00 EST, no destructive or DoS-style scans" | Defines how testing occurs (timing, escalation path, allowed techniques) — a separate document from scope, which defines what. | ||
A WHOIS or crt.sh lookup (passive) vs. an Nmap port scan (active) | • Passive recon pulls from third-party sources and never sends traffic to the target • active recon interacts directly and can be logged or blocked | ||
A separate AWS penetration-testing request form for a client's EC2-hosted assets | A client's sign-off does not cover infrastructure owned by ISPs, MSSPs, or cloud providers — their consent must be obtained separately. | ||
Having valid credentials to a system is not automatic authorization to every file on it (the "gates up / gates down" test) | • The 2021 U.S • Supreme Court ruling narrowed CFAA liability to binary access, not policy violations — jurisdictional law still varies and must be checked | ||
The client asks the team to also check a newly discovered subdomain that wasn't in the original SOW | • Document any requested expansion in writing • Get explicit re-approval before touching new assets. |