# Footprinting and Reconnaissance

> Chapter 2 of the Courseiva EC-CEH curriculum — https://courseiva.com/learn/ec-ceh/footprinting-and-reconnaissance

**Official objective:** 2.1 — Gather information about a target system using passive and active reconnaissance techniques, including footprinting methods.

## Introduction

How do you break into a system you know nothing about?

For the Certified Ethical Hacker (CEH) (312-50) exam, you need to understand that every attack starts with gathering information. Footprinting and reconnaissance are the very first steps an ethical hacker takes, and mastering them is critical because they determine how successful the rest of the test will be. Without solid reconnaissance, you're flying blind.

## The Moving House Analogy

Ever wondered how a detective starts investigating a case before they even knock on a door?

Imagine you're planning to move into a new house, but you've never seen the inside. You wouldn't just show up with a moving truck and start loading furniture, right? No. First, you'd drive by the neighbourhood. You'd look at the street name, the house number, the condition of the roof, and whether there's a big dog in the front yard. You might check online for property records, see who the neighbours are, and look for crime statistics in the area. That's passive reconnaissance — you're gathering information without actually touching the house or talking to anyone inside.

Next, you'd get more active. You'd walk up to the front door, ring the bell, and talk to the current owner. You'd ask about the plumbing, the electrical system, and when the boiler was last serviced. You might even open a cupboard or two. That's active reconnaissance — you're directly interacting with the target (the house) to get more detailed, verified information. In ethical hacking, we do the same thing, but the 'house' is a computer system or a company's network, and the information we gather helps us find weak spots before a real attacker does.

## Core explanation

Let's break down what footprinting and reconnaissance actually mean in the world of ethical hacking.

'Footprinting' is the process of collecting as much information as possible about a target computer system or network. The goal is to create a 'footprint' — a detailed map that shows the organisation's digital landscape, including its employees, its technology, and its vulnerabilities. Think of it like drawing a map of a castle before you plan your siege: you want to know where the walls are, how many guards there are, and where the secret tunnels might be.

'Reconnaissance' is the broader term for all the techniques used to gather this intelligence. It comes from a military word meaning 'to reconnoitre' — to go out and scout ahead of the main force. In cybersecurity, we split reconnaissance into two main flavours: passive and active.

Passive reconnaissance is like eavesdropping without being noticed. You collect information from publicly available sources without directly interacting with your target's systems. This could include:

- Searching on Google for employee names, email addresses, or technical documents (this is called 'Google dorking' or 'Google hacking')
- Looking at the target's social media profiles on LinkedIn, Twitter, or Facebook
- Using free tools like 'Whois' to see who registered their domain name and when
- Checking public databases for news articles, SEC filings, or press releases
- Monitoring their website for job postings (which often reveal what technologies they use)

All of these activities are completely legal — you aren't touching their network, and they can't detect you doing it. This is passive reconnaissance.

Active reconnaissance, on the other hand, is like knocking on the door or walking around the building. You're sending probes or requests that interact directly with the target's systems, and they can potentially detect your presence. Examples include:

- Ping sweeps: sending a 'ping' (a small network request) to a range of IP addresses to see which ones respond, telling you which computers are alive and connected
- Port scanning: trying to connect to different 'doors' (called ports) on a computer to see which services are running (like a web server, email server, or file server)
- Network mapping: using tools to discover the layout of the network, including routers and firewalls
- Banner grabbing: connecting to a service and reading the 'welcome message' that often reveals the software version running (for example, 'Apache/2.4.41 (Ubuntu)')

Why do we need both approaches? Passive reconnaissance builds a foundation of information that's safe and often reveals the big picture. Active reconnaissance then fills in the details, but you must be careful — aggressive active scanning can trigger alarms and get you blocked or even reported. Ethical hackers typically start with passive techniques to build a profile, then use active techniques only when authorised.

Footprinting and reconnaissance are the bedrock of ethical hacking. The more you know about your target before you start testing, the faster and more accurately you can find vulnerabilities. The CEH exam loves to test your understanding of which technique is passive versus active, what tools are used for each, and what kind of information you can obtain from different sources.

One key concept to understand is the 'attack surface'. This is the set of all possible entry points that an attacker could use to gain unauthorised access to a system. Footprinting helps you identify these points — every publicly known email address, every open port, every forgotten subdomain increases the attack surface. Your job as an ethical hacker is to map out this surface so you can recommend shrinking it.

Another important term is 'OSINT' (Open Source Intelligence). This is any information that can be legally gathered from public sources. OSINT is a huge part of passive reconnaissance because you don't need special permission to look at someone's public LinkedIn profile or to read their blog posts. Many powerful OSINT tools automate the process of searching these sources, collecting millions of data points in minutes.

Finally, remember that footprinting isn't a one-time activity. Throughout an engagement, you'll constantly go back and refine your map as you discover new information. A single email address might lead to a social media profile, which reveals a job posting that mentions they use a specific piece of software, which leads you to a known vulnerability in that software. Each piece of information is a clue that points to the next.

## Real-world context

An IT professional — specifically a penetration tester or security analyst — uses footprinting and reconnaissance at the start of almost every security assessment. Let's walk through a realistic scenario.

You're hired by a mid-sized e-commerce company called 'ShopQuick' to test their security. They've given you permission to attack their external web server but nothing else — you have to discover the rest yourself.

First, you do passive reconnaissance. You open a browser and go to the 'ShopQuick' website. You view the page source (by right-clicking and selecting 'View Page Source') and find comments left by developers that reveal internal IP addresses and the name of their database server. Next, you search for 'ShopQuick' on LinkedIn and find the profiles of their IT team. One profile lists their job title as 'AWS Cloud Engineer' — that tells you they likely use Amazon Web Services. You also find their company page on Crunchbase, which mentions they recently raised funding and are expanding. You check whois.com and find that their domain was registered five years ago and the registrant's email address is an admin's personal Gmail account — a security risk. You also use a tool called 'theHarvester' (a popular OSINT tool) to automatically grab a list of email addresses and subdomains from public sources.

Now you have a rough map: you know they use AWS, a few employee names, their domain's registration details, and some subdomains like mail.shopquick.com and dev.shopquick.com.

Now, it's time for some careful active reconnaissance. You start by pinging their main website IP address to see if it responds. It does — the server is alive. Next, you use a tool called Nmap (the Swiss Army knife of network scanning) to perform a 'port scan' on that IP address. You scan the most common ports and discover that port 80 (HTTP) and port 443 (HTTPS) are open — expected for a web server. But you also find port 22 (SSH) open, which usually means someone can connect for remote administration. That's a potential entry point if they use weak passwords. You then connect to port 22 using an SSH client and 'grab the banner' — the welcome message says 'OpenSSH_7.6p1 Ubuntu'. That tells you they're running an older version of Ubuntu and OpenSSH, which might have known vulnerabilities.

Next, you look at the subdomains you found. You try to visit dev.shopquick.com, and it loads a test version of their site with a login page that says 'Admin Panel'. You try a few default usernames and passwords (like 'admin/admin') — none work, but you've identified another potential target.

As an IT professional, you document everything meticulously. You create a report that lists:

- All discovered assets (their main site, subdomains, IP addresses)
- Open ports and services running
- Software versions (e.g., Apache 2.4.41, OpenSSH 7.6p1)
- Employee names and email addresses
- Any weak configurations (like the admin's personal email on the domain registration)

You deliver this to ShopQuick as part of your final report, along with recommendations: patch the old SSH version, remove the internal IPs from page source, use a business email for domain registration, and disable unused subdomains. The client uses this information to close those gaps before a real attacker finds them.

In a real job, you'd never stop at this initial scan. You'd also use tools like 'Shodan' (a search engine for internet-connected devices) to see what else is exposed, and 'Google Dorking' to find sensitive files like database dumps accidentally left on open servers. But the core principle remains: start passive, get a map, then go active to verify and fill details. Always stay in bounds of your permission.

## Exam focus

The CEH 312-50 exam is notorious for testing your knowledge of footprinting and reconnaissance in detail. Here's what you need to know to pass.

First, the exam expects you to distinguish clearly between passive and active reconnaissance. This is a common exam question pattern: they'll describe a scenario and ask 'is this passive or active reconnaissance?' For example, 'A tester uses a tool to search Google for PDF files containing employee information.' The answer is passive — you're not touching the target's systems. Another question: 'A tester sends a SYN packet to a target's IP address to see if a port is open.' That's active, because you're interacting directly with the target's network.

Second, they love to test specific tools and techniques. Memorise the following:

- Whois: used for passive footprinting — reveals domain registration details
- Nmap: used for active reconnaissance — port scanning and service detection
- theHarvester: passive OSINT tool — gathers emails, subdomains, and names
- Google Dorking: passive — using special search operators like 'site:target.com filetype:pdf' to find hidden info
- Shodan: passive — searches for internet-connected devices and their vulnerabilities
- Netcraft: passive — provides web server version and hosting details
- DNS enumeration: digging into DNS records (like MX, A, TXT) — can be passive if you use public DNS servers, or active if you query the target's own DNS server

A third trap the exam sets is around 'what is legal?' Passive reconnaissance is generally legal because you're only accessing publicly available information (like browsing a website). Active reconnaissance, however, can cross into illegal territory if you don't have permission, because you're sending packets to someone else's system. The exam will present scenarios where a tester does something without authorisation, and you must identify that as illegal or unethical.

Fourth, they'll test your understanding of the 'reconnaissance lifecycle'. This includes steps like:

- Gather initial information (company name, domain, IP ranges)
- Locate the network infrastructure (routers, firewalls)
- Identify operating systems and services
- Find employee details via social media
- Determine the target's security posture (what measures they have in place)

You'll also need to know specific terms like 'Social Engineering' (manipulating people into giving up information) and 'Dumpster Diving' (literally going through a company's rubbish to find documents). Both are reconnaissance techniques, though dumpster diving is obviously rare in real ethical hacking because of legal and ethical issues.

Finally, the exam will have multiple-choice questions where you must choose the best tool or technique for a given situation. For example: 'Which tool is best for passively gathering email addresses from a target?' The answer is theHarvester. Or 'Which technique would a penetration tester use to find subdomains of a target?' The answer could be DNS enumeration or Google Dorking.

The key is practises — do a lot of practice questions until you can instantly recall these definitions and tools. Also, pay attention to the exact wording; the exam uses subtle distinctions like 'passive' vs 'active' and 'internal' vs 'external' reconnaissance. Don't let small differences trip you up.

## Step by step

1. **Define the Scope** — Before any reconnaissance, you get a signed authorisation from the client. This defines what systems you can test, what methods are allowed, and what you must avoid. In footprinting, you start here to know the boundaries.
2. **Passive Reconnaissance (OSINT)** — You gather publicly available information using tools like Whois, theHarvester, and Google Dorking. This step is safe and legal, and it gives you a broad map of the target's infrastructure, employee details, and technology stack.
3. **DNS Enumeration** — You query DNS records to discover subdomains, mail servers, and IP addresses. This can be passive (using public DNS) or active (querying the target's own DNS server). It's crucial for mapping the network.
4. **Active Reconnaissance (Port Scanning & Service Detection)** — You use tools like Nmap to scan discovered IP addresses for open ports and running services. You identify software versions (banner grabbing) to find known vulnerabilities. This step must be authorised.
5. **Documentation and Analysis** — You record every finding in a structured report: discovered hosts, open ports, services, employee names, and potential vulnerabilities. This document becomes the basis for the next phase of the ethical hacking engagement.

## Comparisons

### Passive Reconnaissance vs Active Reconnaissance

**Passive Reconnaissance:**
- Collects data from public sources without touching the target's systems.
- Generally legal and undetectable, but some logs may still record automated queries.
- Examples: Whois lookups, Google Dorking, social media profiling.

**Active Reconnaissance:**
- Sends probes (like ping or port scans) directly to the target's network.
- Can be detected by firewalls, IDS, or logging systems and requires explicit authorisation.
- Examples: Nmap port scanning, banner grabbing, ping sweeps.

### Netcraft vs Shodan

**Netcraft:**
- Primarily provides web server version and hosting details based on public website data.
- Often used to identify what technology stack (e.g., Apache, Nginx) a site runs.
- Less focused on discovering obscure internet-connected devices beyond web servers.

**Shodan:**
- Searches for any internet-connected device (routers, cameras, printers) based on banners.
- Shows open ports and services for millions of IPs, useful for finding exposed critical infrastructure.
- Known for discovering unsecured industrial control systems and public-facing databases.

### theHarvester vs Maltego

**theHarvester:**
- A command-line tool primarily used to gather email addresses and subdomains from public sources.
- Focuses on automation of simple OSINT tasks like search engine scraping.
- Straightforward output, often used in scripting and quick reconnaissance.

**Maltego:**
- A GUI-based tool that visually maps relationships between entities (people, domains, email addresses).
- Combines multiple data sources via 'transforms' to reveal hidden connections and patterns.
- More complex to use but provides deeper analysis for large-scale investigations.

### Google Dorking vs DNS Enumeration

**Google Dorking:**
- Uses Google search operators (like site, filetype, intitle) to find sensitive files and info on public websites.
- Passive technique — only involves interacting with Google's public search index.
- Effective for discovering exposed documents, configurations, and admin pages.

**DNS Enumeration:**
- Queries DNS servers to retrieve records (A, MX, CNAME, TXT) that map domain names to IPs and services.
- Can be passive (using public DNS) or active (directly querying target's DNS server).
- Reveals the internal structure of the target's network, such as mail servers and subdomains.

## Diagram

_This diagram shows the two main branches of reconnaissance: passive and active, along with common techniques and tools used in each._

```mermaid
graph LR
    A[Footprinting & Reconnaissance] --> B[Passive Reconnaissance]
    A --> C[Active Reconnaissance]
    B --> D[OSINT]
    B --> E[Google Dorking]
    B --> F[Whois]
    B --> G[theHarvester]
    C --> H[Port Scanning]
    C --> I[Banner Grabbing]
    C --> J[Ping Sweep]
    H --> K[Service Discovery]
```

## Common misconceptions

- **Misconception:** Passive reconnaissance is always safe and undetectable. **Reality:** While passive reconnaissance doesn't directly interact with the target's systems, some advanced monitoring tools can detect certain types of passive data collection, such as if you repeatedly scrape their public website or use automated OSINT tools that leave logs on their DNS server. (Beginners assume 'passive' means 'invisible', but anything you do on someone else's infrastructure (like their website or DNS) can potentially be logged. The line is blurry in practice.)
- **Misconception:** Footprinting is only useful for finding vulnerabilities. **Reality:** Footprinting also helps identify authorised access points, employee email addresses for phishing simulations, and even company mergers or acquisitions that might change the attack surface. It's about building a complete picture, not just weaknesses. (Many beginners think footprinting is only about finding bugs to exploit, but the real value is understanding the entire landscape, which includes both strengths and weaknesses.)
- **Misconception:** You only need passive reconnaissance before active reconnaissance. **Reality:** Reconnaissance is iterative. You might do some active scanning, discover a new subdomain, then go back to passive methods to research that subdomain (like checking its whois record). It's a cycle, not a linear process. (Newcomers often view it as a strict sequence: 'first passive, then active, done.' Real engagements involve constant back-and-forth as new information surfaces.)
- **Misconception:** All publicly available information is legal to use in ethical hacking. **Reality:** Even if something is publicly available, using it without permission for a security test is illegal if you don't have a signed contract. For example, scraping someone's personal social media profile without consent could violate terms of service or privacy laws. (People confuse 'public' with 'free to use for any purpose'. Ethical hacking requires explicit authorisation for the entire scope, including passive methods.)
- **Misconception:** Nmap is only used for port scanning. **Reality:** Nmap can also detect operating systems, run vulnerability scripts, perform service version detection, and even map network topology using traceroute functionality. It's a multi-purpose reconnaissance tool. (Beginners see Nmap's most famous use case (port scanning) and assume that's all it does. The exam tests its broader capabilities.)

## Key takeaways

- Footprinting is the process of systematically gathering information about a target to create a detailed profile of its digital presence.
- Passive reconnaissance involves collecting information from public sources without directly interacting with the target's systems.
- Active reconnaissance requires sending probes to the target's network, which can be detected and may require authorisation.
- OSINT (Open Source Intelligence) is the backbone of passive reconnaissance and includes data from social media, search engines, and public databases.
- Tools like Whois, theHarvester, and Google Dorking are standard for passive footprinting in the CEH exam.
- The attack surface is the total set of potential entry points uncovered through footprinting, which ethical hackers aim to minimise.
- Reconnaissance is an iterative cycle, not a one-time step, and often repeats as new information emerges.
- Legal and ethical boundaries are critical: passive methods are generally safer, but any reconnaissance without permission is illegal.

## FAQ

**What is the difference between footprinting and reconnaissance?**

Footprinting is the specific process of collecting information to create a detailed profile of a target. Reconnaissance is the broader category of techniques used to gather intelligence, which includes footprinting as one of its phases.

**Is it legal to use Google Dorking on a target?**

Google Dorking itself is legal because you're only using a search engine's existing features. However, if you use the information you find to attack a system without permission, that becomes illegal. Always have explicit authorisation before testing.

**What tools are required for the CEH exam's footprinting section?**

You need to know theHarvester, Whois, Nmap, Shodan, Netcraft, Google Dorking operators, and DNS enumeration tools. The exam tests your ability to choose the right tool for a scenario, not their full command-line syntax.

**Can passive reconnaissance ever be detected?**

Yes, in some cases. For example, if you scrape a website too aggressively, the server logs might show unusual traffic. Some advanced security tools can also detect DNS queries from automated OSINT tools. Passive is low-risk but not zero-risk.

**What is a 'banner grab' in active reconnaissance?**

A banner grab is when you connect to a service (like a web server) and read the welcome message it sends. This message often reveals the software name and version, helping you identify vulnerabilities associated with that version.

**How does the CEH exam test footprinting?**

It uses multiple-choice questions that present a scenario and ask you to identify the technique (passive vs active), the tool required, or the type of information obtained. You'll also see questions about the order of operations and legal considerations.

## Check your understanding

1. **A penetration tester uses Nmap to scan a target's IP address and discover open ports. Which type of reconnaissance is this?**

   Answer: Active reconnaissance, because the tester is sending network packets directly to the target's system in order to get a response.

2. **What is the primary difference between footprinting and reconnaissance?**

   Answer: Footprinting is the specific process of creating a detailed profile of a target by collecting information, while reconnaissance is the broader category of techniques (including footprinting) used to gather intelligence.

3. **Name two tools typically used for passive OSINT reconnaissance.**

   Answer: Whois (for domain registration details) and theHarvester (for email and subdomain gathering) are common passive OSINT tools.

4. **In active reconnaissance, what does 'banner grabbing' reveal about a target?**

   Answer: Banner grabbing retrieves the welcome message from a service (like a web server) which often reveals the software name and version, helping identify potential vulnerabilities.

5. **Why is it important to start with passive reconnaissance before active reconnaissance in an ethical hacking engagement?**

   Answer: Passive reconnaissance is low-risk and builds a foundational map of the target without triggering alarms, allowing you to focus active scans on the most promising areas once you have authorisation.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-ceh/footprinting-and-reconnaissance