Mastering Kali Linux for Advanced Penetration Testing - Third Edition

Open Source Intelligence and Passive Reconnaissance

Information gathering is the method of gathering all relevant information from publicly available sources, often referred to as open source intelligence (OSINT). Passive reconnaissance through OSINT occurs during the first step of the kill chain when conducting a penetration test, or an attack against a network or server target. An attacker will typically dedicate up to 75% of the overall work effort for a penetration test to reconnaissance, as it is this phase that allows the target to be defined, mapped, and explored for the vulnerabilities that will eventually lead to exploitation.

There are two types of reconnaissance:

• Passive reconnaissance (direct and indirect)
• Active reconnaissance ...