Reconnaissance: OSINT, Scanning, and Enumeration Techniques

What Is Reconnaissance?

Reconnaissance is the first phase of the attack lifecycle. Before an attacker (or an authorized penetration tester) can exploit anything, they must understand the target: what systems exist, what services are running, and where weaknesses might be found. As a cybersecurity professional, you need to understand these techniques so you can recognize them in logs, defend against them, and conduct authorized assessments yourself.

Reconnaissance divides into two broad categories: passive and active.

Passive Reconnaissance and OSINT

Passive reconnaissance gathers information without sending packets directly to the target. Because no direct contact is made, it is difficult for the target to detect. The primary method is Open Source Intelligence (OSINT) — collecting data from publicly available sources.

Common passive techniques include:

• WHOIS lookups — Query domain registration databases to find the registrant's name, organization, email, name servers, and registration dates. This data is available through registrars and through tools like whois.domaintools.com or the command-line `whois` utility.
• Shodan.io searches — Shodan is a search engine that indexes internet-facing devices and their open ports, banners, and service versions. Searching your own organization's IP range (with explicit authorization) can reveal exposed services you did not know were public.
• Google dorks — Advanced Google search operators such as `site:`, `filetype:`, and `intitle:` can surface indexed files, login pages, and configuration data that the target unintentionally exposed.
• DNS enumeration — Querying DNS records (A, MX, TXT, CNAME) can reveal subdomains, mail servers, and third-party services used by an organization.
• Certificate transparency logs — Public certificate logs list every TLS certificate issued for a domain, revealing subdomains.

Legal and ethical boundary: Passive OSINT on publicly available data is generally lawful, but you must still have a clearly defined, authorized scope. In this course, all OSINT activities are restricted to instructor-designated targets. Using these techniques against any target outside that scope — even just looking — is a policy violation and may be a criminal offense under the Computer Fraud and Abuse Act (CFAA).

Active Scanning

Active scanning sends packets to target systems and analyzes responses. It is detectable and must only ever be performed against systems you own or have explicit written authorization to test. In this lab, the only acceptable active scanning target is the isolated Metasploitable2 VM on the air-gapped subnet provided by the instructor. That VM has no route to the internet or to any production network.

Nmap (Network Mapper) is the industry-standard open-source port scanner. Key flags used in this lab:

• `-sV` — Service version detection: Nmap probes open ports and tries to identify the running application and its version number.
• `-O` — OS fingerprinting: Nmap analyzes TCP/IP stack behavior to estimate the target operating system.

A typical command against the lab VM might look like:

```

nmap -sV -O 192.168.56.101

```

Nmap output lists each open port, the protocol, the state (open/closed/filtered), the service name, and the detected version. This is exactly the information an attacker wants — and exactly what a defender needs to inventory.

Enumeration

Enumeration goes deeper than scanning. Once open ports and services are identified, enumeration extracts specific information: user accounts, shares, running processes, and service banners. Tools such as Netcat (for banner grabbing) and service-specific clients are used. In the CompTIA exam context, enumeration is the step between scanning and exploitation.

Cross-Referencing with the NVD

Knowing a service name and version lets you search the National Vulnerability Database (NVD) at nvd.nist.gov. The NVD catalogs published vulnerabilities as Common Vulnerabilities and Exposures (CVEs). Each CVE entry includes a description, affected versions, a severity score (CVSS), and references to patches or advisories.

For example, if your Nmap scan shows `vsftpd 2.3.4` running on port 21, a NVD search for that string reveals a known backdoor vulnerability. This cross-referencing step transforms raw scan data into an attack surface assessment — identifying which findings represent real, exploitable risk.

Safety and Ethics Rules for This Lab

1. Scope is absolute. Active scanning targets only the lab VM. Passive OSINT targets only instructor-designated sites. No exceptions.

2. Network isolation must be verified before starting any Nmap scan. Confirm with your instructor that the VM subnet has no internet routing.

3. Document your authorization. Your reconnaissance report must note the date, the authorized target, and the instructor's name. This mirrors professional practice where a signed Rules of Engagement document precedes any assessment.

4. Automatic fail rule. Any evidence that active scanning was directed at unauthorized targets results in an automatic zero and an academic integrity referral. This mirrors real-world legal exposure under the CFAA.

5. Handle findings responsibly. Treat all data collected — even from a lab VM — as if it were sensitive. Do not post screenshots or IP addresses to public forums or social media.

Building the Reconnaissance Report

A professional reconnaissance report organizes findings so a client or security team can act on them. Your one-page report (using the provided template) should include:

• Target and scope — what was authorized, who authorized it, and when.
• Passive findings — WHOIS data, Shodan results, Google dork discoveries, sources cited.
• Active findings — open ports, service versions, OS fingerprint from Nmap.
• CVE cross-reference — at least three CVEs matched to discovered services, with CVSS scores.
• Attack surface assessment — which findings represent the highest risk and why.

This report structure maps directly to the skills tested on CompTIA Security+ (threat analysis) and CySA+ (vulnerability management and reporting).