Lesson 3 of 12

Reconnaissance & OSINT

Reconnaissance is the first and most critical phase of any penetration test. You will learn passive and active information-gathering techniques using open-source intelligence tools to build a detailed profile of a target without ever touching their systems. The more you know before attacking, the more effective your test will be.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is about pattern recognition — training your eye to spot specific things in the wild. You are learning to look at a situation and immediately categorize it correctly. Think of it like learning to identify different types of birds: at first everything looks the same, but with practice you start seeing the distinguishing features instantly.

Why this matters

Scanning and reconnaissance are the foundation of every real-world penetration test. Before you can find or fix vulnerabilities, you need to know exactly what is running on a network. This is the skill that separates guesswork from methodical, professional security work.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Reconnaissance & OSINT · Objective 1 of 4

VIDEO

Loading video…

Set up a legal practice target on TryHackMe

Create a free account at tryhackme.com and navigate to the Learning Paths section, where you will find machines specifically designed for recon exercises in the Pre-Security or Jr Penetration Tester paths. Download the OpenVPN configuration file from your account settings and connect from Kali using the command below — keep this terminal window open throughout the exercise. Never practice reconnaissance techniques on real websites or companies you do not have explicit written permission to test, because even passive techniques like DNS enumeration can trigger security alerts and potentially legal action. TryHackMe provides a completely legal environment where you can practice freely without any risk of violating the law.

sudo openvpn ~/Downloads/tryhackme.ovpn

Perform passive DNS reconnaissance with whois and dig

Run whois against your target domain to gather registration information — this is entirely passive and sends no packets to the target itself. Note the registrar, registration date, name servers, and any contact information that appears. Then use dig to enumerate different DNS record types: A records reveal IP addresses, MX records show mail servers, TXT records often contain SPF and DKIM configurations, and NS records show the authoritative name servers. A common pitfall is stopping at just A records — MX and TXT records frequently reveal cloud services, email providers, and security configurations that are valuable for building a complete picture of the target.

whois target.com && dig target.com A && dig target.com MX && dig target.com TXT && dig target.com NS

Enumerate subdomains with multiple tools

Use Sublist3r to discover subdomains through search engine scraping and DNS brute-forcing, running it with the -v flag for verbose output so you can see which sources are finding results. Also run theHarvester separately to collect email addresses and additional subdomains from LinkedIn, Google, and Bing — different tools find different results, so using multiple tools gives better coverage. Each subdomain you discover is a potential attack surface: dev.target.com, staging.target.com, and admin.target.com are frequently less hardened than the main production site. Save all output to files immediately because some tools do not save results automatically and you will lose them if the terminal closes.

sublist3r -d target.com -v -o subdomains.txt && theHarvester -d target.com -b google,bing,linkedin -f harvester-results

Use Google Dorks to find exposed information

Google Dorks are advanced search operators that find information Google has indexed about your target, and they are entirely passive — you are only reading what Google already knows. Start with site:target.com to see all indexed pages, then use site:target.com filetype:pdf to find documents, and site:target.com inurl:admin to find admin panels. The operator site:target.com -www shows subdomains other than www, which often reveals development and staging environments. A critical pitfall: do not use Google Dorks aggressively in a short time period because Google will temporarily block your IP for automated-looking queries — space out your searches and document every interesting URL you find, even if it seems minor at first.

Search Shodan for internet-facing infrastructure

Go to shodan.io and search for your target organization name or IP range — Shodan continuously scans the entire internet and indexes what services are running on every IP address, making it essentially a search engine for internet-connected devices. Search for the organization name to find servers, IoT devices, and services they have exposed, then filter results by port to find specific services: port:22 shows SSH servers, port:3389 shows RDP, and port:8080 shows web servers on non-standard ports. A common finding is development or staging servers that are accidentally exposed to the internet with weaker security than production systems. Note every finding with the date you found it, since infrastructure changes over time.

open https://www.shodan.io

Compile all findings into a structured recon report

Create a markdown file and organize your findings into clear sections: Target Overview (company name, primary domain, IP ranges), DNS Infrastructure (subdomains, name servers, mail servers), Email Addresses Found, Technologies Identified (from HTTP headers, job postings, LinkedIn), Interesting URLs (admin panels, login pages, API endpoints), and Open Questions (things you want to investigate further in the next phase). This report becomes the input for your scanning phase — a well-organized recon report saves hours during exploitation because you can quickly reference what you found instead of re-running tools. Include the date and time of each finding since infrastructure changes over time.

nano ~/recon-report.md

Previous: Setting Up Your Lab Environment Next Lesson