Cyber Kill Chain — Reconnaissance
Press Next → or use ← → arrow keys
The Cyber Kill Chain — 7 Phases
Lockheed Martin's model describes the stages an intruder moves through. Reconnaissance is the first link — and the earlier you break the chain, the cheaper the defense.
An attack only succeeds if every link holds. Break any one and the intrusion fails — so defenders push detection as far left as possible. Recon is the leftmost, cheapest place to win.
The Breach That Started With a Fish Tank
Attackers don't break in where you're strong — they enter where you didn't know you were exposed. Reconnaissance is how they find that place, and it happens before any alarm is designed to trip.
What Is Reconnaissance?
Reconnaissance is the information-gathering phase — the attacker builds a detailed picture of the target's people, technology, and exposure before acting. Like a burglar watching a house for a week: which doors, which hours, which neighbours notice.
Much of recon uses publicly available information and generates no traffic to the target at all — which is exactly why it's so hard to detect and so valuable to the attacker.
Passive vs Active Reconnaissance
Gathers intel from third parties (search engines, public records, social media). The target sees nothing. Low risk, huge yield.
Interacts directly with the target's systems (scanning, probing). Faster & deeper — but it hits logs, so it can be detected.
How Passive Recon Works (OSINT)
None of this requires touching the target. Automated OSINT frameworks stitch these sources into one profile in minutes — turning scattered public facts into a precise map.
How Active Recon Works
Active recon is faster and more precise — but every probe is a footprint in your logs. Skilled attackers scan slowly and from many IPs to blend into normal internet background noise.
Reconnaissance in 2026
Modern recon is continuous and automated. Attackers watch for the moment you spin up a new server, leak a key, or post a job ad — and pounce on the window before you notice.
"Footprinting" — The Formal Name for Recon
In the CEH/ethical-hacking body of knowledge, reconnaissance is called Footprinting — "the collection of every possible piece of information about the target and its network." It is the first step of ethical hacking.
Passive & active (as covered) · Internet footprinting (via search engines/apps) · Pseudonymous footprinting (posting under an assumed name so intel traces back to someone else, not the attacker).
The Footprinting Methodology
A disciplined engagement works through these sources in order — then documents every finding.
A legitimate engagement begins with authorization & a defined scope and ends by documenting all findings — the same rigor a defender uses to audit their own exposure.
Google Dorking & the GHDB
Advanced search operators turn a search engine into a precision recon tool — surfacing files and pages that were indexed but never meant to be found.
| Operator | Finds | Operator | Finds |
|---|---|---|---|
| site: | Results within a domain | intitle: | Keyword in page title |
| related: | Similar web pages | inurl: | Keyword in the URL |
| cache: | Google's cached copy | intext: | Keyword in body text |
| link: | Pages linking to a URL | filetype: | Specific file types (pdf, xls…) |
Popularized by Johnny Long, the GHDB (hosted on exploit-db.com) is a curated library of dork queries that expose login portals, exposed config files, error messages, and vulnerable devices. Defenders check it against their own domain to find what leaks.
WHOIS Footprinting & the 5 RIRs
Registrant name & org, country, name servers, IP address & location, ASN, domain status, and registration/expiry dates — plus WHOIS, IP, registrar & hosting history.
Enable registrar privacy/redaction so registrant emails & phone numbers don't become free phishing fuel.
| RIR | Acronym | Region |
|---|---|---|
| African Network Information Center | AFRINIC | Africa |
| American Registry for Internet Numbers | ARIN | US, Canada, parts of the Caribbean, Antarctica |
| Asia-Pacific Network Information Centre | APNIC | Asia, Australia, New Zealand & neighbours |
| Latin America & Caribbean Network Info Centre | LACNIC | Latin America & parts of the Caribbean |
| Réseaux IP Européens Network Coordination Centre | RIPE NCC | Europe, Russia, Middle East, Central Asia |
DNS Footprinting — Reading the Records
DNS records quietly describe an organization's mail, hosts, and services. Knowing the record types is knowing where to look.
| Record | Reveals |
|---|---|
| A | Host's IP address |
| MX | Mail server |
| NS | Name server |
| CNAME | Aliases to a host |
| SOA | Authority for the domain |
| Record | Reveals |
|---|---|
| SRV | Service records |
| PTR | IP → host (reverse) |
| RP | Responsible person |
| HINFO | Host / OS info |
| TXT | Unstructured text (SPF, keys) |
HINFO can hand an attacker your OS; TXT records often leak third-party services via SPF. Prune what you publish and disable zone transfers to strangers.
Network Footprinting & Traceroute
Network address ranges · hostnames · exposed hosts · OS & app versions · patch state · the structure of apps & back-end servers.
whois · ping · nslookup · tracert / traceroute. Ping also reveals if a host is live, its TTL, and (via the DF bit) the path MTU.
C:\> tracert example.com
1 1 ms 192.168.0.1 <- gateway
2 * request timed out
3 2 ms 110.37.216.157
…
16 213 ms 152.195.65.133
17 211 ms 93.184.216.34 <- target
Trace complete.Each hop maps a router between attacker and target — building the network map.
Rate-limit/deny ICMP at the edge, hide internal hops, and watch for traceroute/scan bursts in your logs — active network footprinting is detectable.
Email & Website Footprinting
Old credentials, staff names, and directory structures live on in archived snapshots and search caches long after you remove them. Assume anything ever public is still public.
The Recon Toolkit (Awareness)
These are the same tools blue teams and pen-testers run on their own organization — an OSINT self-assessment shows you exactly what an attacker would collect.
Footprinting Countermeasures
Run the whole methodology against your own organization on a schedule — the fastest way to find and close what leaks before an attacker maps it.
How Scattered Facts Become an Attack Map
Any single fact looks harmless. But combined — a name + email format + a vulnerable service version + a reused password — they become a precise, low-noise plan of attack. Recon's true output is focus.
What Attackers Are Hunting For
| They want… | Because it enables… |
|---|---|
| Employee names & email format | Targeted phishing & password-spray lists |
| Exposed services & versions | Matching a known, unpatched vulnerability |
| Forgotten / shadow IT assets | An unmonitored way in (the fish tank) |
| Leaked credentials & API keys | Logging in instead of breaking in |
| Vendors & partners | A softer supply-chain route to you |
| Org structure & who's new | Convincing pretexts for social engineering |
"Why hack in if you can log in?" Most modern intrusions start not with an exploit, but with information — a valid credential, a known bug, an exposed asset — all found during reconnaissance.
Recon-Led Breaches You Know
In every case, the quiet first phase decided the whole attack. The exploit was almost a formality once recon had found the right person, vendor, or exposed system.
Can You Detect Reconnaissance?
Passive recon is nearly invisible — but active recon and its follow-through leave traces if you're watching.
You may not stop someone looking at public data — but detected recon is a free warning that you're being targeted, giving you time to harden before the real attack lands.
Shrink What Recon Can Find
Every asset you retire, every secret you rotate, every banner you hide makes the attacker's map emptier — pushing them toward noisier methods you can detect.
Passive vs Active — Side by Side
| Aspect | Passive recon | Active recon |
|---|---|---|
| Touches the target? | No — third-party sources | Yes — direct probing |
| Detectability | Nearly invisible | Visible in logs |
| Speed & depth | Slower, broad | Faster, precise |
| Example | WHOIS, LinkedIn, Shodan, CT logs | Port scans, banner grabs, enumeration |
| Best defense | Reduce OSINT footprint | Monitoring, IDS/IPS, deception |
Real campaigns start passive (quiet, build the picture), then go active only to confirm the few targets worth the risk. Your defense must cover both halves.
Golden Rules of Reconnaissance
The Battle Begins Before the Breach
Reconnaissance is the patient, quiet work that decides every later phase — mapping people, technology, and exposure, mostly from public data. Defenders win by seeing their own surface first, shrinking it, and turning an attacker's probing into an early warning. Break the chain at the first link and the rest never happens.
Attackers study you before they touch you — so study yourself first. Next in the kill chain: Weaponization, where intel becomes a tailored payload.
🎯 End of tutorial · Press ← to review, or click Restart