Reconnaissance and information gathering in Cybersecurity - Step-by-Step Execution

Concept Flow - Reconnaissance and information gathering

Start Reconnaissance

↓

Passive Reconnaissance

↓

Collect Public Info

↓

Analyze Data

↓

Decide Next Step

↓

Active Reconnaissance

↓

Scan Target Systems

↓

Gather Detailed Info

↓

Report Findings

↓

End

The process starts with passive reconnaissance to gather public info, then may proceed to active reconnaissance for detailed data, ending with reporting findings.

Execution Sample

Cybersecurity

1. Search public websites for target info
2. Analyze collected data
3. If needed, scan target systems
4. Collect detailed info
5. Compile report

This sequence shows how reconnaissance moves from passive data collection to active scanning and reporting.

Analysis Table

Step	Action	Method	Data Collected	Next Step
1	Start Reconnaissance	Initiate process	None	Passive Reconnaissance
2	Passive Reconnaissance	Search public sources	Domain names, IPs, emails	Analyze Data
3	Analyze Data	Review collected info	List of targets and details	Decide Next Step
4	Decide Next Step	Evaluate info sufficiency	Decision to scan or report	Active Reconnaissance or Report Findings
5	Active Reconnaissance	Scan target systems	Open ports, services, vulnerabilities	Gather Detailed Info
6	Gather Detailed Info	Use tools like Nmap	Detailed system info	Report Findings
7	Report Findings	Compile and summarize	Final report	End
8	End	Complete process	Reconnaissance complete	None

💡 Process ends after reporting findings and completing reconnaissance.

State Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
Data Collected	None	Public info (domains, IPs)	Analyzed target list	Scanned system details	Final report

Key Insights - 3 Insights

Why do we start with passive reconnaissance instead of active scanning?

Passive reconnaissance gathers info without alerting the target, as shown in step 2 of the execution_table, making it safer and less detectable.

What determines if we move from passive to active reconnaissance?

Step 4 in the execution_table shows a decision based on whether the collected data is enough; if not, active scanning is done for more details.

What kind of data is collected during active reconnaissance?

According to step 5 and 6, active reconnaissance collects detailed info like open ports and services using scanning tools.

Visual Quiz - 3 Questions

Look at the execution_table, what data is collected during step 2?

A Open ports and services

B Domain names, IPs, emails

C Final report

D Detailed system info

💡 Hint

Check the 'Data Collected' column for step 2 in the execution_table.

At which step does the process decide whether to scan target systems?

A Step 5

B Step 3

C Step 4

D Step 7

💡 Hint

Look at the 'Next Step' column in step 4 of the execution_table.

If no detailed info is needed, which step is skipped?

A Active Reconnaissance

B Passive Reconnaissance

C Analyze Data

D Report Findings

💡 Hint

Refer to the decision point at step 4 in the execution_table.

Concept Snapshot

Reconnaissance gathers info about a target.
Start with passive methods (public data).
If needed, do active scanning (ports, services).
Analyze and report findings.
Passive is stealthy; active is detailed but detectable.

Full Transcript

Reconnaissance and information gathering in cybersecurity involves collecting data about a target system or network. The process begins with passive reconnaissance, where publicly available information such as domain names, IP addresses, and emails are collected without interacting directly with the target. This is safer and less likely to alert the target. After analyzing this data, a decision is made whether to proceed with active reconnaissance, which involves scanning the target systems to find open ports, running services, and potential vulnerabilities. Tools like Nmap are commonly used for this. Finally, all gathered information is compiled into a report. This step-by-step process helps security professionals understand the target environment before further actions.

Practice

1. What is the main purpose of reconnaissance in cybersecurity?

easy

A. To gather information about a target system or network

B. To fix vulnerabilities in software

C. To encrypt data for security

D. To create user accounts on a system

Solution

1. Step 1: Understand the role of reconnaissance

   Reconnaissance is the initial phase where information about a target is collected to plan further actions.

2. Step 2: Identify the correct purpose

   Among the options, only gathering information fits the reconnaissance phase.

3. Final Answer:

   To gather information about a target system or network -> Option A

4. Quick Check:

   Reconnaissance = Information gathering [OK]

Hint: Reconnaissance means collecting info first [OK]

Common Mistakes:

• Confusing reconnaissance with fixing or attacking
• Thinking it involves encryption
• Assuming it creates accounts

2. Which of the following commands is commonly used for passive reconnaissance to find domain information?

easy

A. ping

B. nmap

C. whois

D. netstat

Solution

1. Step 1: Identify passive reconnaissance tools

   Passive reconnaissance collects data without interacting directly with the target system.

2. Step 2: Match command to passive info gathering

   The whois command queries public domain registration info without contacting the target directly.

3. Final Answer:

   whois -> Option C

4. Quick Check:

   Passive info tool = whois [OK]

Hint: whois shows domain info without touching target [OK]

Common Mistakes:

• Using ping which sends packets actively
• Confusing nmap as passive (it scans actively)
• Thinking netstat gathers external info

3. Consider this command output from nmap -sP 192.168.1.0/30:

Host 192.168.1.1 is up
Host 192.168.1.2 is up
Host 192.168.1.3 is down
Host 192.168.1.4 is up

What does this output tell you?

medium

A. All hosts are unreachable

B. Hosts 192.168.1.1, 1.2, and 1.4 are reachable; 1.3 is not

C. Only 192.168.1.3 is reachable

D. The scan failed due to syntax error

Solution

1. Step 1: Understand nmap ping scan output

   The -sP option checks which hosts respond to ping requests in the given IP range.

2. Step 2: Interpret the output lines

   Hosts marked "is up" respond and are reachable; "is down" means no response.

3. Final Answer:

   Hosts 192.168.1.1, 1.2, and 1.4 are reachable; 1.3 is not -> Option B

4. Quick Check:

   Ping scan shows reachable hosts = 1.1, 1.2, 1.4 [OK]

Hint: Look for 'is up' = reachable hosts [OK]

Common Mistakes:

• Assuming 'is down' means reachable
• Thinking all hosts are unreachable
• Confusing syntax error with normal output

4. A user runs the command nslookup example.com but gets an error saying "server can't find example.com". What is the most likely cause?

medium

A. The DNS server is unreachable or misconfigured

B. The domain example.com does not exist

C. The user typed the command incorrectly

D. The network cable is unplugged

Solution

1. Step 1: Understand nslookup error message

   The error "server can't find" usually means the DNS server queried cannot resolve the domain.

2. Step 2: Analyze possible causes

   If the domain exists, the likely cause is DNS server issues, not user typo or physical network problems.

3. Final Answer:

   The DNS server is unreachable or misconfigured -> Option A

4. Quick Check:

   DNS error = server unreachable or misconfigured [OK]

Hint: DNS errors often mean server issues, not typos [OK]

Common Mistakes:

• Assuming domain does not exist without checking
• Blaming user typo without evidence
• Thinking physical cable issues cause DNS errors

5. You want to gather email addresses from a company website without alerting their security systems. Which reconnaissance method should you use?

hard

A. Active scanning with port scanners

B. Brute force login attempts

C. Sending phishing emails

D. Passive reconnaissance by analyzing public web pages

Solution

1. Step 1: Understand active vs passive reconnaissance

   Active methods interact directly and can alert security; passive methods gather info without direct contact.

2. Step 2: Choose method to avoid detection

   Analyzing public web pages is passive and safe for collecting emails without triggering alarms.

3. Final Answer:

   Passive reconnaissance by analyzing public web pages -> Option D

4. Quick Check:

   Safe info gathering = passive reconnaissance [OK]

Hint: Use passive methods to avoid detection [OK]

Common Mistakes:

• Using active scans that trigger alerts
• Trying brute force which is illegal and noisy
• Confusing phishing with reconnaissance