OSINT Reconnaissance Explained: Passive Information Gathering for PenTest+

Open source intelligence gathering is the first phase of a penetration test and the one with the least risk of detection. Tools like theHarvester automate it, collecting email addresses, subdomains, hostnames and employee names from public sources without ever touching the target's systems.

Passive versus active

The distinction PenTest+ tests most directly.

Passive reconnaissance gathers information from third parties. Search engines, DNS records, WHOIS, certificate transparency logs, social media, job advertisements, breach data, public code repositories. The target's systems are never contacted, so nothing appears in their logs.

Active reconnaissance interacts with the target directly. Port scanning, banner grabbing, DNS zone transfer attempts, vulnerability scanning. Detectable, and requires authorisation.

The boundary is subtler than it looks. Querying a DNS server the target controls is arguably active. Visiting their website leaves an entry in their web logs. Treat the line as: does my traffic reach infrastructure the target operates?

And note that passive being undetectable does not make it unlimited. Scope and rules of engagement still govern what you may collect and what you may do with it.

What gets collected, and why it matters

Email addresses and naming convention. The single most valuable output. Discovering that addresses follow firstname.lastname@company.com means any employee name found anywhere becomes a probable valid address — the raw material for phishing and password spraying.

Employee names and roles. From professional networks, conference listings, press releases and paper authorship. Feeds pretexting and identifies who holds privileged access.

Subdomains and hostnames. Expands the attack surface. Forgotten development, staging and legacy subdomains are frequently less protected than production.

Technology stack. Job advertisements are startlingly informative — a posting asking for experience with a specific firewall, ERP and cloud platform describes the environment precisely.

Breached credentials. Previously exposed passwords for corporate addresses, which credential stuffing turns into access wherever passwords are reused.

Document metadata. Published PDFs and Office files often retain usernames, internal paths, software versions and printer names.

Certificate transparency

Worth knowing separately because it is so productive and so often overlooked. Every publicly trusted TLS certificate is logged in public, append-only certificate transparency logs. Searching those logs for a domain reveals every subdomain anyone has ever requested a certificate for — including internal-sounding hosts that were never meant to be advertised.

It is entirely passive, requires no permission, and frequently finds hosts that DNS enumeration misses.

Running it responsibly

Authorisation comes first even for passive work, because scope defines what "the target" means and collecting personal data about employees has privacy implications. Agree in writing what may be gathered and how it will be stored.

Handle collected data as sensitive. A reconnaissance file containing employee names, email addresses and breached passwords is exactly the kind of material that should not sit unencrypted on a laptop. Delete it at the end of the engagement per the contract.

And verify before acting. Automated collection returns stale and incorrect results — addresses of people who left years ago, subdomains long decommissioned. Acting on unverified data wastes effort and can affect systems outside scope.

Reducing your own footprint

The defensive side, which CySA+ cares about.

Strip metadata from documents before publishing. Keep job advertisements generic about specific products and versions. Review what staff share publicly about internal systems. Audit DNS regularly and decommission unused records. Monitor certificate transparency logs for certificates issued on your domains — this also detects unauthorised issuance. Watch breach corpora for your own domain's addresses and force resets. And enforce multifactor authentication, which is what makes harvested credentials far less useful.

You cannot prevent OSINT. You can reduce what there is to find, and make what is found less valuable.

Where it appears

PenTest+ (PT0-003) covers reconnaissance techniques and the passive/active distinction in the information gathering domain.

CySA+ (CS0-003) addresses attack surface management and reducing exposure.

Security+ (SY0-701) touches OSINT as a threat intelligence source.

What to remember

Passive reconnaissance uses third-party sources and leaves no trace on the target; active interacts directly and needs authorisation. Email naming conventions are the highest-value finding. Certificate transparency logs expose subdomains that nothing else reveals. Get authorisation even for passive work, treat the results as sensitive, and verify before acting on them.

Related reading: WHOIS · FOCA and metadata OSINT · STRIDE threat modeling