Overview
Passive reconnaissance begins with public records — information about an organization and its assets that is openly available without touching the target. This lesson covers gathering intelligence from public sources.
Learning objectives
- Explain what public records reveal in recon.
- Identify categories of publicly available information.
- Keep passive recon lawful and ethical.
Core concept
Public records are openly available sources of information about an organization and its infrastructure — for example, domain registration information, publicly listed services, public code/documentation, job postings (which hint at technologies used), and other openly published data. Because this information is already public, gathering it is passive: it does not touch the target's systems. It helps build an early picture of the organization's footprint and technology.
How it works
The tester collects openly available information to understand the target's footprint: what domains and infrastructure are associated with it, what technologies it likely uses (from public postings, documentation, or code), and other openly published details. This is aggregated into the recon picture and asset inventory. Because it uses public sources rather than probing the target, it is undetectable by the target and low-risk — but it must still be relevant to scope and gathered lawfully (using genuinely public information, not accessing anything protected). It provides context that focuses later active phases.
Practical example
Assessing an authorized organization, the tester reviews openly available information — such as public domain registration details and publicly posted technology information — to infer the organization's infrastructure footprint and likely technology stack. This context (e.g. "they appear to use a particular platform") helps focus later testing, all gathered from public sources without touching the target. The information feeds the asset inventory and recon documentation.
Cybersecurity relevance
Public-records gathering (a form of OSINT — covered in depth in the OSINT path) is a standard passive recon technique and mirrors what real attackers do to profile a target cheaply and undetectably. For defenders, it highlights the value of minimizing exposed information (reducing what is public about infrastructure and technology). Ethical practice requires using only genuinely public information, staying relevant to scope, and never accessing protected data under the guise of "public records."
Common mistakes
- Accessing protected/non-public information and calling it public records.
- Gathering irrelevant information not tied to the authorized scope.
- Overlooking public-records recon, missing cheap, undetectable context.
Key takeaways
- Public records are openly available information about an organization and its infrastructure (registration data, public postings/documentation/code) that can be gathered without touching the target.
- It is passive, undetectable, and low-risk, building an early footprint/technology picture that focuses later phases.
- Use only genuinely public information, stay relevant to scope, and gather lawfully; it mirrors attacker profiling and highlights minimizing exposed information for defenders.
Check your understanding
- Why is gathering public records considered passive and undetectable by the target?
- What ethical boundary must be respected when gathering "public" information?