Overview
Reconnaissance produces an asset inventory — an organized catalog of the systems, services, and components discovered within scope. This inventory is the structured output that drives the rest of the engagement. This lesson covers building an asset inventory.
Learning objectives
- Define an asset inventory in the recon context.
- Describe what it catalogs.
- Connect the inventory to systematic testing.
Core concept
An asset inventory is a structured catalog of the in-scope assets discovered during recon: hosts and IPs, domains and subdomains, exposed services and ports, applications and their endpoints, technologies and versions, and notable functionality. It transforms scattered recon findings into an organized model of the target's attack surface, ensuring that everything discovered is accounted for and can be systematically tested. It parallels the "mapping" phase from the web methodology, applied to the broader target.
How it works
As recon gathers information, the tester records each discovered asset and its relevant attributes in an organized inventory. This catalog answers "what is there to test?" and lets the tester ensure coverage — no discovered host, service, or endpoint is forgotten. The inventory also helps prioritize (e.g. focus on higher-value or more-exposed assets) and provides a reference throughout the engagement. It must reflect only in-scope assets; anything discovered but out of scope is noted as excluded, not tested.
Practical example
During recon of an authorized target, the tester builds an inventory listing the in-scope hosts, the services/ports found on each, the web applications and their key endpoints, and the detected technologies. This organized catalog becomes the reference for testing: the tester works through it systematically, ensuring each in-scope asset and service is assessed. An out-of-scope system that surfaced during recon is recorded as excluded and left untouched.
Cybersecurity relevance
An asset inventory is what enables systematic, comprehensive testing rather than ad hoc probing — a hallmark of professional methodology. It ensures coverage, supports prioritization, and provides a shared reference for the engagement and its report. For defenders, maintaining an accurate asset inventory is itself a key security practice (you cannot protect what you do not know you have). Building an inventory during recon reflects the disciplined, organized approach that distinguishes effective assessments.
Common mistakes
- Not organizing recon findings, leading to forgotten assets and inconsistent coverage.
- Including out-of-scope assets in the testable inventory instead of marking them excluded.
- Omitting attributes (services, technologies, endpoints) that guide testing.
Key takeaways
- An asset inventory is an organized catalog of in-scope discovered assets: hosts/IPs, domains, services/ports, applications/endpoints, and technologies.
- It turns scattered recon into a structured model of the attack surface, ensuring coverage and enabling prioritization.
- It drives systematic testing and serves as an engagement reference; only in-scope assets are testable, with out-of-scope ones noted as excluded.
Check your understanding
- What does an asset inventory catalog, and why is it important for coverage?
- How should an out-of-scope asset discovered during recon appear in the inventory?