Overview
Reconnaissance is the information-gathering phase of a web security test — understanding the target before testing it. Done within scope, it builds the picture needed for effective, focused assessment. This lesson covers recon in a web methodology.
Learning objectives
- Explain the goal of reconnaissance.
- Distinguish passive from active recon.
- Identify what information recon gathers (within scope).
Core concept
Reconnaissance gathers information about the in-scope target to inform testing. Two modes:
- Passive recon — collecting information without directly interacting with the target in an intrusive way (e.g. reviewing publicly available information, documentation, or provided materials).
- Active recon — interacting with the target within scope to learn about it (e.g. observing responses, enumerating endpoints), which is more detectable and must stay within authorized limits.
The aim is to understand the technology stack, entry points, and structure so testing is targeted rather than blind.
How it works
Within the authorized scope, the tester assembles a picture of the application: the technologies in use, the endpoints and parameters, authentication mechanisms, and the general structure. Passive methods gather what is available without intrusive interaction; active methods probe the application directly (staying within scope and rules). The gathered information feeds the mapping phase (next) and guides where to focus testing. Good recon makes the rest of the assessment efficient and thorough, ensuring important areas are not missed.
Practical example
Testing an in-scope web application, the tester first reviews provided documentation and observable, non-intrusive information to understand the stack and features (passive), then, within scope, browses the application to enumerate its pages, endpoints, and parameters and note the authentication flow (active). This builds an inventory of the app's surface — which the tester will organize in the mapping phase and use to prioritize testing. All interaction stays within the authorized targets and rules.
Cybersecurity relevance
Reconnaissance shapes the effectiveness of an assessment: a thorough understanding of the target ensures broad coverage and focused effort, while poor recon leads to missed areas. It must always respect scope — active recon interacts with the target and is detectable, so it stays within authorized limits. Recon is a standard early phase in methodologies like the OWASP testing approach and directly enables mapping and targeted testing. It reflects the professional discipline of understanding a system before probing it.
Common mistakes
- Skipping recon and testing blindly, missing parts of the application.
- Conducting active recon outside authorized scope or against excluded systems.
- Failing to organize gathered information for the mapping and testing phases.
Key takeaways
- Reconnaissance gathers information about the in-scope target to make testing focused and thorough.
- Passive recon avoids intrusive interaction; active recon interacts with the target (more detectable) and must stay within scope and rules.
- Recon builds the picture (stack, endpoints, auth, structure) that feeds mapping and targeted testing; it is a standard early phase, always within authorization.
Check your understanding
- What is the difference between passive and active reconnaissance?
- Why does reconnaissance improve the thoroughness and efficiency of a web security assessment?