Reconnaissance and OSINT for Penetration Testers Cheat Sheet

Reconnaissance is the first working phase of a penetration test, the systematic collection of information about a target before any exploit is attempted. It sits between scoping and active vulnerability scanning, turning a client's name or domain into a concrete inventory of subdomains, exposed services, technologies, and employees that decide where the rest of the engagement even starts. Most of this phase is passive, pulling from WHOIS records, certificate transparency logs, search engines, and internet-scanning databases like Shodan and Censys without a single packet reaching the target, which keeps it both legally low-risk and invisible to the target's defenders. The practical skill is not any one tool but cross-referencing: the same subdomain discovered by certificate transparency, DNS enumeration, and a search-engine dork corroborates itself, while a single unconfirmed hit is noise. Every technique below still operates inside a signed scope and rules of engagement — recon that drifts outside authorized targets is the fastest way to turn a legitimate assessment into a legal problem.