Overview
Reconnaissance splits into passive and active techniques, which differ in how directly they interact with the target — and therefore in detectability and scope sensitivity. This lesson distinguishes the two.
Learning objectives
- Define passive and active reconnaissance.
- Explain their differences in interaction and detectability.
- Connect the distinction to scope and stealth.
Core concept
- Passive reconnaissance gathers information without directly interacting with the target's systems in an intrusive way — using publicly available information, third-party sources, and observation that does not touch the target. It is generally undetectable by the target.
- Active reconnaissance directly interacts with the target (e.g. probing services, enumerating endpoints) to gather information. It is more informative but detectable and must stay strictly within authorized scope.
The distinction matters for both detectability and authorization sensitivity.
How it works
Passive recon draws on information that does not require touching the target's systems, so it neither alerts the target nor risks impact — but it is limited to what is externally observable. Active recon interacts with the target to learn more (service details, live endpoints), yielding richer data at the cost of generating traffic the target can detect and log, and requiring clear authorization since it touches the systems. In an engagement, testers typically start passive (broad, low-risk understanding) and move to active recon within scope as authorized.
Practical example
Assessing an authorized target, the tester first does passive recon — assembling an understanding from publicly available information and non-intrusive observation, without touching the target. Then, within the authorized scope, they perform active recon by directly interacting with the in-scope systems to enumerate services and endpoints. The active phase yields more detail but generates traffic the target could log — so it is done deliberately and within authorization, while the passive phase raised no such concerns.
Cybersecurity relevance
The passive/active distinction is fundamental to recon strategy and stealth: passive methods are low-risk and undetectable but limited; active methods are richer but detectable and scope-sensitive. Real attackers and testers alike weigh this trade-off. For defenders, active recon leaves traces (logs, unusual traffic) that monitoring can detect — an early-warning signal. Understanding which techniques touch the target, and ensuring active recon stays within authorization, is essential to conducting recon responsibly and effectively.
Common mistakes
- Confusing passive with active, underestimating when an activity actually touches the target.
- Performing active recon outside scope, treating "information gathering" as exempt from authorization.
- Relying only on passive recon and missing detail, or jumping to active recon without understanding detectability.
Key takeaways
- Passive recon gathers information without intrusively touching the target (undetectable, limited); active recon directly interacts with it (richer, detectable, scope-sensitive).
- The distinction affects detectability and authorization sensitivity; testers typically start passive, then do active recon within scope.
- Active recon leaves detectable traces (useful to defenders) and must stay within authorization — understanding which techniques touch the target is essential.
Check your understanding
- What is the key difference between passive and active reconnaissance in terms of interaction and detectability?
- Why must active reconnaissance stay strictly within authorized scope?