Passive vs. Active Reconnaissance

Learning Objectives

• Define passive, semi-passive, and active reconnaissance and give examples of each
• Explain what makes an activity detectable by the target, and what traces it leaves
• Identify where reconnaissance crosses the legal line and requires authorization
• Map common recon activities to MITRE ATT&CK Reconnaissance (TA0043) techniques
• Describe how OSINT hands off to scanning and enumeration in a penetration test

The Core Question: Who Do You Touch?

The difference between passive and active reconnaissance comes down to one question: does your activity send traffic to, or interact with, the target’s own systems or people?

• Passive reconnaissance gathers information without interacting with the target directly. You query third parties (search engines, registries, archives, scan databases) that already hold the data.
• Active reconnaissance interacts directly with the target’s systems or people: sending packets, probing services, or contacting employees.

Between them is a semi-passive gray zone: interacting with the target in a way that looks like normal, expected traffic.

Analogy from the intro script:
- Passive: looking at a house from the street, on real estate listings, and on satellite maps
- Semi-passive: walking in the front door of a store during business hours, like any customer
- Active: walking around the building jiggling doorknobs and testing windows

Passive Reconnaissance

Passive recon relies on data someone else already collected. The target has no direct way to see it happening, because your requests never reach them.

Examples:
- Search engine queries, including advanced operators
- Reading professional networking profiles and public social media (while logged out, or with a research account; see Module 8 OPSEC for platforms that notify people when you view them)
- WHOIS/RDAP registration lookups
- Certificate Transparency log searches for subdomains
- Passive DNS and historical DNS databases
- Internet scan search engines (the scanning was done by someone else, earlier)
- Archived pages in web archives
- Public records, business filings, and news
- Breach notification lookups for your own or authorized domains

Strengths: stealthy, low legal risk (when done within ToS and law), cheap, fast to start.
Weaknesses: data may be outdated (the scan database saw that port open three months ago), incomplete, or wrong. Passive findings often need confirmation, which may require authorized active techniques.

“Passive” doesn’t mean invisible

Even passive recon can leave traces:
- Some platforms show who viewed a profile or story
- Submitting a URL to a public scanner or archive can make that submission visible to others
- Clicking a link can load tracking content controlled by the target
- Some third-party services share or sell query data

These are OPSEC concerns, covered in Module 8.

Semi-Passive Reconnaissance

Semi-passive recon touches the target’s systems, but only in ways a normal user or the normal internet would.

Examples:
- Browsing the target’s public website like any visitor
- Reading the target’s robots.txt or sitemap.xml file in a browser
- Standard DNS lookups for the target’s public records (these go to the target’s DNS provider)
- Viewing the TLS certificate the site presents in your browser

What the target can see: your IP address, browser user agent, and which pages you requested, sitting in their web server logs among thousands of other visitors. Normally nobody looks. But an organization watching closely (or one already alerted) could notice a visitor who downloads every PDF on the site at 3 a.m.

Why it’s called a gray zone: it’s generally treated as acceptable and low-risk, but it is not invisible, and some engagements define “passive only” strictly enough to exclude it. Read the rules of engagement. To stay fully passive, view archived copies of pages instead (see Module 5 OSINT Sources).

Active Reconnaissance

Active recon interacts directly with the target to get current, detailed information.

Examples:
- Port scanning and service/version detection
- Vulnerability scanning
- Directory and file brute forcing (“wordlist scanning”) against a web server
- DNS zone transfer attempts and brute forcing subdomains against the target’s name servers
- Banner grabbing by connecting to services
- Sending emails, calling employees, or sending messages to gather information (pretexting)
- Physically visiting a site to observe badges, doors, and entrances

Strengths: current and detailed; confirms what passive sources suggest.
Weaknesses: detectable, logged, can trigger alerts and blocks, can disrupt fragile systems, and requires authorization.

Comparison Table

*Passive for the target organization, but some platforms notify the individual.

Detectability: What Defenders Look For

Understanding detection helps attackers stay quiet and helps defenders catch recon early (see Module 9 Defending Against OSINT).
- Network scanning shows up as many connection attempts to many ports or hosts from one source, often blocked or alerted on by firewalls and intrusion detection systems.
- Web brute forcing creates bursts of “not found” errors and unusual user agents, often caught by web application firewalls.
- Social engineering may be reported by trained employees, especially when several staff receive similar odd requests.
- Semi-passive browsing is usually invisible in the noise, unless the pattern is unusual (downloading every document, crawling at high speed).

Defenders also watch for signs of passive recon results being used: lookalike domains being registered, phishing emails that reference real internal details, or leaked credentials being tested.

The Legal Line

This connects directly to Module 2 Legal & Ethical Boundaries.

• Passive recon is generally legal when you stay within the law, the platforms’ terms of service, and ethical limits. The main risks are ToS violations, privacy law, and how you use the information.
• Active recon against systems you don’t own or aren’t authorized to test can be treated as unauthorized access or attempted intrusion depending on the jurisdiction and what you did. At minimum it can get your IP blocked, trigger an incident response, and draw abuse complaints to your internet provider or school.
• Social engineering without authorization can involve fraud or impersonation laws and causes real harm to the people contacted.

The practical rule: passive by default; active only with written authorization that explicitly covers the technique and the targets. “The company is in scope” does not automatically mean “you may scan every IP that looks related”; shared hosting and third-party services (cloud providers, SaaS platforms) usually belong to someone else.

Where to practice active techniques legally

• Systems you own (a home lab, your own VMs)
• Intentionally vulnerable practice platforms and labs provided by your instructor
• scanme.nmap.org, a host the Nmap Project explicitly set up for people to test scans against, with limits on how often you scan it (check the current terms on the page before class)

Mapping to MITRE ATT&CK: Reconnaissance (TA0043)

MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques. Its Reconnaissance tactic (TA0043) is described as “the adversary is trying to gather information they can use to plan future operations.” Defenders use these IDs to describe and detect recon; red teams use them to plan and report.

The last two are recent additions to ATT&CK. The knowledge base is updated regularly, so check the live Reconnaissance page before class for the current list.

Using the mapping in class: after a lab, have students label each step of their investigation with an ATT&CK ID. It reinforces the passive/active distinction and introduces the vocabulary they’ll use in 7.0 Red Team and 8.0 Blue Team.

The Handoff: From OSINT to Scanning and Enumeration

In a penetration test, reconnaissance is the first phase, and it feeds everything after it:

Passive OSINT ──► Semi-passive checks ──► Active scanning ──► Enumeration ──► Vulnerability analysis ──► Exploitation
 (this unit)                                (authorized)      (2.2 Web Hacking and later units)

What OSINT hands off:
- A target list: domains, subdomains, IP ranges, and cloud services that are confirmed to belong to the client (and a list of look-alikes that don’t, so nobody scans a stranger’s server)
- Technology hints: web frameworks, VPN products, email platforms, and security tools, so active testing can focus
- People and roles: for authorized social engineering
- Leads to confirm: “the scan database showed an exposed admin panel on this host three months ago”

Good OSINT makes active testing faster, quieter, and safer. Scanning blindly without it wastes time and risks hitting systems outside scope. Scanning and enumeration techniques are covered starting in 2.2 Web Hacking.

Key Terms

• Passive reconnaissance: gathering information without interacting with the target’s systems or people
• Semi-passive reconnaissance: interacting with the target in ways that resemble normal traffic
• Active reconnaissance: directly probing the target’s systems or contacting its people
• Rules of engagement (RoE): the written terms defining what testers may do, to which targets, and when
• Banner grabbing: connecting to a service to read the identifying information it returns
• DNS zone transfer: a request for a full copy of a domain’s DNS records, which misconfigured name servers may allow
• Wordlist scanning / brute forcing: guessing paths, files, or subdomains from a list
• MITRE ATT&CK: a public knowledge base of adversary tactics and techniques
• Enumeration: actively extracting detailed information (users, shares, services) from a target

Key Takeaways

• The key question: does your activity touch the target’s systems or people?
• Passive = third-party data, very hard to detect, sometimes outdated
• Semi-passive = normal-looking traffic, but it still lands in the target’s logs
• Active = direct probing: detectable, current, and requires written authorization
• Passive by default; active only when the RoE explicitly allows it
• MITRE ATT&CK TA0043 gives recon activities standard IDs defenders and red teams share
• OSINT hands a verified target list and leads to the scanning phase

References

• Reconnaissance, Tactic TA0043 — MITRE ATT&CK
• Nmap Project, scanme.nmap.org scanning terms (http://scanme.nmap.org/) — could not load the page during writing; check the current terms before class (verify before class)