CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Scraping a website means fetching its pages programmatically and pulling structured data out of the HTML. In a security context it is the first phase of an engagement: before anyone touches a login form or scans a port, they read everything the target has already published. The exam framing is that this is passive reconnaissance — you are only requesting pages the site serves to everyone. What is actually worth harvesting The obvious prize is people. Staff directories, leadership pages, press releases, and job postings yield names, job titles, department structure, and often the email address format. Once you know that the pattern is first initial plus last name, every name you found becomes a probable mailbox. Job postings are startlingly generous. A listing asking for experience with a specific firewall vendor, a named SIEM, a particular ERP version, and a cloud platform has just described the technology stack in enough detail to plan an approach. Nobody thinks of recruitin...

Open source intelligence collection is easy to start and hard to keep organized. A handful of searches produces domains, subdomains, hostnames, IP addresses, email addresses, employee names, and leaked credentials, and within an hour it is scattered across browser tabs and text files with no way to tell what came from where. OSINT frameworks exist to impose structure on that mess. What a framework adds The core idea is a shared data store with typed records . Domains, hosts, contacts, credentials, and network ranges are stored as entities in a workspace rather than as lines of text, and each is tagged with the source it came from. That makes results chainable. Discovered domains feed subdomain enumeration; discovered hosts feed address resolution and geolocation; discovered names feed email address generation. Each module consumes what previous modules produced, so the collection compounds instead of requiring manual copying between tools. It also makes the work reproducible and r...

FOCA — Fingerprinting Organizations with Collected Archives — is an OSINT tool that finds documents published on a target's websites, downloads them, and extracts the metadata hidden inside. It is a reconnaissance tool, and what it reveals about most organizations is uncomfortable. Every document an organization publishes carries metadata nobody looked at. FOCA collects it at scale and assembles it into a map of the internal network and the people on it. What It Does, Step by Step Search. FOCA queries search engines for documents on a target domain, using operators equivalent to site:target.com filetype:pdf across many file types. Download. It retrieves every document it finds — PDFs, Word, Excel, PowerPoint, OpenOffice formats, and more. Extract. It parses each file's metadata. Correlate. This is the valuable part. It aggregates findings across hundreds of documents to build a picture no single file would reveal. What Comes Out Usernames. Document autho...

Open source intelligence gathering is the first phase of a penetration test and the one with the least risk of detection. Tools like theHarvester automate it, collecting email addresses, subdomains, hostnames and employee names from public sources without ever touching the target's systems. Passive versus active The distinction PenTest+ tests most directly. Passive reconnaissance gathers information from third parties. Search engines, DNS records, WHOIS, certificate transparency logs, social media, job advertisements, breach data, public code repositories. The target's systems are never contacted, so nothing appears in their logs. Active reconnaissance interacts with the target directly. Port scanning, banner grabbing, DNS zone transfer attempts, vulnerability scanning. Detectable, and requires authorisation. The boundary is subtler than it looks. Querying a DNS server the target controls is arguably active. Visiting their website leaves an entry in their web logs. Treat...

WHOIS is the protocol and the service for querying who registered a domain name or holds an IP address block. It is a standard reconnaissance tool, and it appears on PenTest+ under passive information gathering and on CySA+ under investigation. What a record contains A domain record traditionally shows the registrant's name, organisation, postal address, email and phone; administrative and technical contacts; the registrar; creation, update and expiry dates; the authoritative name servers; and the domain status codes. An IP allocation record shows the organisation the block is assigned to, the regional registry responsible, the CIDR range, and abuse contact details. The regional internet registries are worth recognising: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and AFRINIC for Africa. What changed, and why records look empty now If you have run WHOIS recently you will have seen redacted output, and the ...

Collecting open source information is easy and produces a pile of facts. Intelligence is something else: information that has been evaluated, analysed and delivered to someone who will act on it. The intelligence cycle is the process that converts one into the other, and skipping phases is why so much threat intelligence goes unread. Data, information, intelligence Worth separating before anything else. Data is a raw observation — an IP address, a hash, a domain registration. Information is data with context — that address hosted a phishing site last week. Intelligence is information analysed against a decision — that infrastructure belongs to a group that targets our sector, and here is what to do about it. Most "threat intelligence" feeds deliver information at best. They are useful, and they are an input to intelligence rather than the product. The six phases 1. Direction. Someone with a decision to make states what they need to know. This is the phase mo...

Metadata is data about data — who created a file, when, with what software, and often a great deal more. It is generated automatically, it is invisible in normal use, and it travels with the file. That combination is why it is simultaneously a privacy problem, a reconnaissance goldmine, and one of the most valuable sources in a forensic investigation. What files carry Office documents and PDFs record the author name, the organization, the software and version used to create them, creation and last-modified timestamps, total editing time, and sometimes the full local file path — which discloses internal usernames and server names. Track changes and comments may survive in a document that looks final, and earlier revisions can remain embedded. Images record camera make and model, lens, exposure settings, the software used to edit, and timestamps. Where location services were enabled, they record GPS coordinates, which is the disclosure covered under geotagging and EXIF dat...

The video above shows site: and nothing else — one operator, one example, no mention of the syntax rules that make it actually work or the half-dozen other operators that solve problems site: can't. This guide fills in the rest: the exact syntax search engines expect, how to combine operators instead of using them one at a time, and a genuinely useful side note — these same operators are the first tool a penetration tester reaches for during reconnaissance, which means knowing them cuts both ways. The Operator From the Video: site: site: restricts results to one domain. The syntax matters more than it looks: no space after the colon, and no https:// or www. in front of the domain. site:homedepot.com cordless drill That returns pages on homedepot.com that mention "cordless" and "drill" — it's a filter layered on top of a normal search, not a replacement for one. Flip it around with a minus sign and it excludes a domain instead of requiring it: -s...