Effective ethical hacking starts long before you launch a single tool against a target. It begins with reconnaissance, the disciplined art of intelligence gathering. This isn't just about running a quick whois lookup; it's about systematically mapping a target's digital and human landscape to uncover potential weaknesses. A thorough recon phase provides the foundation for every subsequent step of a penetration test.

This process is split into two fundamental approaches: passive and active. Passive reconnaissance is like being a detective, gathering clues from public sources without alerting your target. Active reconnaissance is more direct, involving interactions that might be logged or noticed. Mastering both is key to building a complete picture of your target's defenses.

Passive reconnaissance, or Open-Source Intelligence (OSINT), is about finding what's already out there. You're looking for information that a company and its employees have unintentionally left exposed on the internet. The goal is to collect as much data as possible without ever sending a single packet to the target's servers.

One of the most powerful tools for this is advanced search engine querying, often called Google Dorking . By using specific operators, you can filter search results to find things that should never have been public, like sensitive documents, configuration files, or login pages.

Beyond search engines, specialized tools give you a different view of the internet. Shodan is a search engine for internet-connected devices. Instead of web pages, it finds servers, webcams, industrial control systems, and more. You can use it to discover a target's exposed hardware, see what software versions they're running, and find outdated systems that might be vulnerable.

Another essential tool is Maltego. It's a data-mining tool that visualizes relationships between different pieces of information. You can start with a single piece of data, like a company's domain name, and Maltego will automatically scour the web to find related email addresses, social media profiles, associated networks, and other domains, presenting it all as an interactive graph.

While passive methods are stealthy, active reconnaissance provides more detailed and accurate technical data by directly probing the target's systems. This approach carries a higher risk of detection but is often necessary to confirm vulnerabilities and map network infrastructure.

A classic active technique is DNS enumeration. By querying a company's Domain Name System (DNS) servers, you can attempt to discover all the subdomains and hostnames associated with their primary domain. One of the most aggressive and revealing methods is attempting a DNS Zone Transfer (AXFR).

This command asks the DNS server ns1.target.com for its entire record for target.com. If the server is misconfigured, it will dump a list of all subdomains, which is an invaluable roadmap for an attacker.

Active reconnaissance also extends to the human element. By profiling employees using social media and professional networks like LinkedIn, you can identify key personnel, understand the corporate hierarchy, and gather information for potential social engineering pretexts. You might look for disgruntled employees, new hires who may not know security protocols, or IT staff who share too much technical detail online.

All findings, from both passive and active reconnaissance, must be meticulously documented. This intelligence forms the basis of your initial report to the client and guides the entire penetration testing engagement. It helps you decide which systems to target, what exploits might be effective, and how to stay under the radar.