Reconnaissance phase in penetration testing

Any successful penetration test, like a viable attack, begins with careful collection of information about the target. The reconnaissance or intelligence gathering phase is an absolutely crucial stage that lays the foundation for all further pentester activities. The more valuable information that can be gathered at this stage, the greater the likelihood of identifying vulnerabilities and successfully conducting the test. At nFlo, we place great importance on methodical and thorough reconnaissance, using both passive techniques and controlled active activities.

Why is the reconnaissance phase crucial to a successful penetration test?

Reconnaissance allows pentesters to understand an organization’s “attack surface” (attack surface) – that is, all points through which a potential attacker can interact with its systems. The goal of this phase is to build as complete a picture as possible of the client’s IT infrastructure, applications, personnel and processes that could potentially be used in an attack.

Without a thorough reconnaissance, a penetration test would be like wandering in the dark. The information gathered allows you to:

• Identifying potential targets: Determining which systems, applications or services are available and may be of interest to an attacker.
• Technology discovery: Understand what operating systems, web servers, databases or frameworks are being used, which helps narrow the search for known vulnerabilities.
• Infrastructure mapping: Learning about IP addresses, domains, subnets, relationships between systems.
• Finding entry points: Identifying open ports, running services, login forms, APIs.
• Planning further actions: Selecting the most promising attack vectors and exploitation strategies.

A thorough reconnaissance increases the efficiency of the entire test, allowing you to focus your efforts on the most likely areas of risk and avoid wasting time on irrelevant targets.

What passive reconnaissance (OSINT) techniques does nFlo use?

Passive reconnaissance, also known as Open Source Intelligence (OSINT), involves gathering information about a target without directly interacting with its systems. This uses publicly available sources, making these activities undetectable to client monitoring mechanisms. nFlo experts use a wide range of OSINT techniques, including:

• Analysis of the company’s website: Search for contact information, employee names, technology (e.g., in HTML code, HTTP headers), links to other systems.
• Search engines: Using advanced search operators (aka Google Dorking) to find hidden files, login pages, sensitive information accidentally published on the web.
• DNS servers: Query DNS records (A, MX, TXT, SRV, etc.) to identify domains, subdomains, mail servers and other infrastructure elements.
• WHOIS registries: check information about domain owners, contact information, name servers.
• Social and professional media (e.g. LinkedIn): Search for information about employees, their positions, technologies used, potential targets for social engineering.
• Code repositories (e.g., GitHub): Search for publicly available source code that may contain API keys, passwords or architecture information.
• Web archives (e.g., Wayback Machine): Analyzing historical versions of Web pages for information that has been deleted.
• Specialized OSINT tools: Use of tools that automate the collection of information from various sources (e.g. theHarvester, Maltego, Shodan).

Passive reconnaissance allows you to build a solid knowledge base about your target while minimizing the risk of detection.

What is active reconnaissance and how does nFlo approach it safely?

Active reconnaissance involves direct interaction with the target’s systems to gather more detailed information. These activities can potentially be detected by the client’s security systems (IDS/IPS, firewall), so they must be conducted in a controlled manner and in accordance with established test rules. Typical active reconnaissance techniques used by nFlo include:

• Port scanning: Using tools such as Nmap to identify open TCP and UDP ports on identified IP addresses, which indicates running services.
• Enumeration of services: Closer examination of identified open ports to determine the type and version of service running (e.g., web server, database, SSH).
• Vulnerability scanning: Using scanners (e.g., Nessus, OpenVAS) to proactively search for known vulnerabilities on identified systems and services.
• Fingerprinting of operating systems and applications: Attempting to accurately identify versions of systems and software.

It is crucial that active reconnaissance is carried out in a safe and non-invasive manner. At nFlo, we ensure that the scan is configured appropriately (e.g., in terms of intensity) so as not to overload the client’s systems and cause disruption to their operation. We always operate within the agreed scope and strictly adhere to the rules of the test, communicating with the customer in case of any concerns.

What information about the target is collected during the reconnaissance?

The goal of the reconnaissance phase is to collect the widest possible spectrum of information that can be useful in further stages of the test. Examples of categories of data to be collected include:

• Network information: IP address ranges, domains, subdomains, network topology, active hosts, open ports.
• Information about systems: Operating systems, software versions, running services, configurations.
• Information about applications: Technologies used (languages, frameworks), application structure, entry points (forms, APIs), authentication mechanisms.
• Personnel information: Names, email addresses, phone numbers, organizational structure (potential targets for phishing or social engineering).
• Security information: Firewalls in use, IDS/IPS systems, attack protection mechanisms (e.g. WAF).
• Potential vulnerabilities: Known vulnerabilities in used software versions, configuration errors, weak passwords (found, for example, in public leaks).

The more detailed and accurate the information collected, the easier it will be to plan and carry out effective actions in the subsequent phases of the test.

How do the results of the reconnaissance affect further stages of the test?

Information gathered during reconnaissance is analyzed and used to model threats and plan attack strategies. Based on the identified technologies, open ports and potential vulnerabilities, nFlo pentesters decide which attack vectors are most promising and which exploitation techniques to use.

For example, if reconnaissance reveals a working old web server with a known vulnerability, it will become a priority target in the exploitation phase. If employee e-mail addresses are found, they can be used to launch a simulated phishing attack (as part of social engineering testing, if in scope). Identification of specific software versions allows to find and test known exploits for them.

Reconnaissance results shape the rest of the penetration test. They allow efficient management of time and resources, focusing on areas with the greatest potential risk. A thorough reconnaissance is the first and one of the most important steps toward a realistic assessment of an organization’s security.

Reconnaissance phase in nFlo

Impact on Test: The results guide the selection of attack vectors and exploitation strategies in subsequent phases.

Goal: Understand the target, identify attack surfaces and potential weaknesses.

Critical importance: The foundation for successful planning and execution of further phases of the test.

Passive Reconnaissance (OSINT): Gathering information from public sources without direct interaction (websites, DNS, social media, search engines). Secure and undetectable.

Active Reconnaissance: Direct interaction with the target (port scanning, service enumeration, vulnerability scanning). Performed in a controlled and secure manner.

Information Collected: Data on networks, systems, applications, personnel, security, potential vulnerabilities.