Reconnaissance methodologies

Reconnaissance is the first and arguably most important phase of any security assessment. Before a single exploit is attempted, a tester needs to understand the target: what it exposes, what technologies it runs, and where the weak seams are likely to be. Get recon right and everything downstream becomes faster and more accurate. Get it wrong and you waste days chasing dead ends.

This guide breaks reconnaissance into the four domains you will actually work in — web, infrastructure, wireless, and Bluetooth — and gives you a practical methodology, the go-to tools for each, and the trade-offs between staying quiet and going deep.

Key takeaways

• Passive first, active second. Gather everything you can without touching the target, then confirm with active probes.
• Recon defines your attack surface. Hidden subdomains, forgotten hosts, and leaked credentials are found here, not during exploitation.
• Every domain has its own toolkit. Web recon, network recon, Wi-Fi, and Bluetooth each demand different techniques.
• Only test what you are authorized to test. Recon still touches real systems and, in many places, is legally regulated.

What Is Reconnaissance in Cybersecurity?

Reconnaissance (“recon”) is the process of collecting information about a target system, organization, network, or device before testing begins. Think of it like studying the map, weather, and terrain before a long hike — the more you learn up front, the fewer surprises you hit later. In an authorized penetration test, thorough recon is what separates a checklist scan from an assessment that actually reflects how a real attacker would approach the target.

Passive vs. Active Reconnaissance

Every technique falls into one of two categories, and knowing which one you are using matters for both stealth and legality.

• Passive reconnaissance collects information without directly interacting with the target — using search engines, WHOIS records, certificate transparency logs, social media, and public data. Because you never touch the target's systems, it is nearly undetectable.
• Active reconnaissance involves direct interaction: port scanning, service probing, and content discovery. It returns far richer data but generates logs and can trip alerts, so it is normally done only within an agreed engagement scope.

Web Reconnaissance Methodology

Websites and web applications are usually the most visible part of an organization, which makes them a natural starting point. The goal here is to map the application's footprint, identify the technologies behind it, and surface hidden or forgotten assets.

1. Domain and DNS Intelligence

Start with the basics: WHOIS registration data, DNS records (A, MX, TXT, CNAME), and hosting information. These reveal how the web presence is structured and often point to related infrastructure.

2. Subdomain Enumeration

Large organizations run dozens of subdomains — dev., staging., api., vpn. — and forgotten ones are frequent entry points. Certificate transparency logs (via crt.sh) and tools like Amass and Subfinder expand the visible attack surface dramatically.

3. Technology Fingerprinting

Identify the web server, framework, and CMS so you can focus on their known weaknesses. HTTP response headers, error pages, and tools like Wappalyzer or WhatWeb quickly reveal the stack.

4. Content and Endpoint Discovery

Many sites contain unlinked directories, backup files (.bak, .old), admin panels, and API endpoints. Directory brute-forcing with tools such as Gobuster or ffuf uncovers these, while inspecting JavaScript files often reveals hidden API routes that never appear in the UI.

Infrastructure Reconnaissance Methodology

While web recon looks at applications, infrastructure recon maps the servers, networks, and services beneath them — the layer where misconfigured services and unpatched software live.

Core Steps

1. Identify network ranges. Public IP blocks (ASNs) tied to the organization define where you look.
2. Port scanning. Nmap is the industry standard for discovering open ports and the services behind them.
3. Service enumeration. Banners reveal software and version numbers, which map directly to known CVEs.
4. Vulnerability scanning. Tools like Nessus or OpenVAS flag missing patches and weak configurations at scale.

Public sources add crucial context here too. Shodan indexes internet-connected devices — servers, routers, cameras, even industrial control systems — and can reveal external exposure the organization may not even realize exists. (For a passive, Shodan-powered take on port scanning, see our guide to Smap.)

Wireless (Wi-Fi) Reconnaissance Methodology

Wireless signals extend beyond physical walls, so an attacker in the parking lot can sometimes interact with your network. Wi-Fi recon focuses on discovering nearby networks and assessing how they are secured.

• Discovery: Capture SSIDs, BSSIDs, signal strength, channels, and encryption types.
• Passive monitoring: Tools like Kismet listen to broadcast traffic (and can reveal hidden SSIDs) without transmitting.
• Packet analysis: Wireshark helps you understand authentication flows and spot weaknesses.
• Encryption review: WEP and WPA are outdated and weak; WPA2 is the baseline and WPA3 is preferred.

The Aircrack-ng suite is the best-known toolkit for authorized wireless assessments, combining discovery, capture, and analysis.

Bluetooth Reconnaissance Methodology

With smartwatches, headphones, medical devices, and IoT sensors everywhere, Bluetooth — especially Bluetooth Low Energy (BLE) — is an increasingly important and under-tested attack surface.

• Device discovery: Enumerate nearby devices, their addresses, names, and advertised services.
• Profile and service enumeration: Bluetooth profiles define capabilities (audio, file transfer, HID); BLE recon maps services and characteristics.
• Pairing and traffic review: Weak pairing or unencrypted traffic can expose sensitive data.

On Linux, the BlueZ stack provides management and analysis capabilities, while hardware like Ubertooth enables deeper monitoring.

Reconnaissance Tools at a Glance

A Note on Ethics and Legality

Even passive recon can cross legal lines, and active recon almost always requires written authorization. Always operate within an agreed scope, respect applicable laws, and follow responsible disclosure. Our Terms & Disclaimer covers this in more detail.

Frequently Asked Questions

Is reconnaissance illegal?

Passive recon using public information is generally lawful, but active recon (such as port scanning) against systems you do not own or have permission to test can be illegal in many jurisdictions. Always get written authorization first.

What is the difference between passive and active reconnaissance?

Passive recon gathers information without touching the target (search engines, WHOIS, certificate logs), so it is stealthy. Active recon interacts directly with the target (scanning, probing), which yields more detail but can be logged and detected.

Which single tool should a beginner learn first?

Nmap. It is the foundation of infrastructure reconnaissance, is extremely well documented, and the concepts you learn (ports, services, banners) carry over to almost every other tool.

How long should reconnaissance take?

It varies with scope, but recon often consumes 30–50% of a professional engagement. Rushing it is one of the most common reasons assessments miss critical exposures.

Related Reading

• Penetration Testing: Finding Vulnerabilities Before Attackers Do
• Minimizing Exposure: Keeping Windows Services Local with ACLs and Zero Trust
• Smap: A Passive, Shodan-Powered Alternative to Nmap

Authoritative References

• OWASP Web Security Testing Guide — information gathering methodology
• MITRE ATT&CK: Reconnaissance (TA0043)
• Nmap Reference Guide

Conclusion

Reconnaissance is where a security assessment is won or lost. By combining passive and active techniques across web, infrastructure, wireless, and Bluetooth, you build a complete picture of the attack surface — hidden assets included — before any exploitation begins. Done thoroughly and ethically, recon lets defenders find and close their exposures before a real attacker ever gets the chance.