CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Search engines index what they can reach, and what they can reach is frequently more than anyone intended. Documents, administrative interfaces, directory listings and error pages containing internal detail all end up indexed — and because the index is public and searchable, finding them requires no scanning, no tooling and no contact with the target at all. Why it is purely passive The distinction matters on the exam and in scoping. Querying a search engine touches the search engine, not the target. Nothing appears in the target's logs, there is no rate limit to trip and no detection to evade. Which means this is the first thing an attacker does and the cheapest thing a defender can check. It is also the reason a finding here cannot be detected after the fact — you will never know someone looked. What operators surface Search engines support qualifiers that narrow results to a site, a file type, a URL pattern, a page title or body text. Combining them turns a general...

Wardriving is collecting wireless network observations while moving — network name, hardware identifier, encryption type and location. Aggregated into public databases over two decades, the result is a searchable map of hundreds of millions of wireless networks worldwide, including almost certainly yours. What gets collected, and why it is passive Access points broadcast beacon frames continuously so clients can find them. Those beacons contain the network name, the radio's hardware identifier, the supported rates and the security configuration — all in the clear, by necessity, before any association occurs. A device listening while its location is recorded builds a database entry per network. Nothing is connected to and nothing is attacked, which makes this passive reconnaissance : the collector never transmits to the target. That classification matters on the exam, and it also means there is no way to detect that it happened. Hiding the network name does not remove yo...

Scraping a website means fetching its pages programmatically and pulling structured data out of the HTML. In a security context it is the first phase of an engagement: before anyone touches a login form or scans a port, they read everything the target has already published. The exam framing is that this is passive reconnaissance — you are only requesting pages the site serves to everyone. What is actually worth harvesting The obvious prize is people. Staff directories, leadership pages, press releases, and job postings yield names, job titles, department structure, and often the email address format. Once you know that the pattern is first initial plus last name, every name you found becomes a probable mailbox. Job postings are startlingly generous. A listing asking for experience with a specific firewall vendor, a named SIEM, a particular ERP version, and a cloud platform has just described the technology stack in enough detail to plan an approach. Nobody thinks of recruitin...

Censys continuously scans the entire public IPv4 address space, connects to every responsive port it finds, and records what answers back. The result is a searchable index of banners, TLS certificates, HTTP headers, and service fingerprints for essentially every internet-facing host on earth. For CySA+ and Security+ candidates, the important idea is not the tool itself but the category it represents: passive reconnaissance against data someone else already collected . Why internet-wide scanning exists Scanning one target announces your interest to that target. Querying a pre-built index does not. Censys, Shodan, and similar services do the scanning once, publicly, and sell or give away the results. An attacker searching that index touches only the index, never the victim. That is why exam questions classify this as passive reconnaissance even though the underlying data came from active scans. The same asymmetry is why defenders use it. Most organizations cannot tell you, with confi...

A conventional port scanner opens a connection, waits for the result, and moves on. That serialization is fine for a single subnet and hopeless at internet scale. Asynchronous scanners break the pattern by decoupling transmission from reception, and the resulting speed difference — hours instead of months — is what made internet-wide scanning practical for everyone, attackers and defenders alike. Why asynchronous scanning is fast The design separates two independent loops. One thread transmits probe packets as fast as the network interface allows, never waiting for a reply. Another receives and records whatever comes back. Nothing blocks on a timeout, because nothing is waiting. Keeping no per-connection state is the second trick. Rather than tracking which probes are outstanding, the scanner encodes identifying information into the packet itself — in fields such as the initial sequence number — so a response can be matched to its probe by inspection. Memory ...

Banner grabbing is connecting to a network service and reading the identification string it sends back. Many services announce themselves on connection — software name, version number, sometimes the operating system and build. That single line converts "something is listening on this port" into "this host runs a specific version with specific known vulnerabilities." What a banner contains A mail server greeting typically opens with a 220 response naming the product and version. A web server discloses through the Server header and often through X-Powered-By. SSH announces its protocol and implementation version before authentication begins. FTP and Telnet greet with product strings, and database and remote access services frequently do the same. Some of this is protocol-mandated. The SMTP greeting exists because the standard requires one, which is part of why SMTP is such a reliable fingerprinting target. The version detail inside it, however, is a vendor defaul...

Open source intelligence collection is easy to start and hard to keep organized. A handful of searches produces domains, subdomains, hostnames, IP addresses, email addresses, employee names, and leaked credentials, and within an hour it is scattered across browser tabs and text files with no way to tell what came from where. OSINT frameworks exist to impose structure on that mess. What a framework adds The core idea is a shared data store with typed records . Domains, hosts, contacts, credentials, and network ranges are stored as entities in a workspace rather than as lines of text, and each is tagged with the source it came from. That makes results chainable. Discovered domains feed subdomain enumeration; discovered hosts feed address resolution and geolocation; discovered names feed email address generation. Each module consumes what previous modules produced, so the collection compounds instead of requiring manual copying between tools. It also makes the work reproducible and r...

Nmap answers three questions in order: which hosts are up, which ports are open on them, and what is listening behind those ports. Almost every option you will meet on an exam is a variation on one of those three. Host Discovery Before scanning ports, Nmap decides which targets are worth scanning. By default it sends a small mix of probes — ICMP echo, a TCP ACK to port 80, a TCP SYN to 443, and an ARP request on the local segment — and treats anything that answers as up. Two flags matter: -sn performs host discovery only and skips port scanning entirely. This is the "ping sweep", and it is the right first step against an unfamiliar range. -Pn skips discovery and treats every target as up. Use it when ICMP is filtered, which is common; expect it to be slow, because Nmap will scan addresses that do not exist. On a local network ARP discovery is used automatically and cannot be blocked by a host firewall, which is why local sweeps are both fast and reliable. TC...

An organization's attack surface is the set of hosts reachable under its domains, and almost nobody has an accurate list. Subdomains accumulate through projects, marketing campaigns, vendor integrations and migrations, and they outlive whoever created them. Enumerating them is the first step of an assessment, and one class of finding — subdomain takeover — is severe and entirely preventable. Passive enumeration No contact with the target, which makes it the first step and undetectable. Certificate transparency logs are the richest source. Every publicly trusted certificate is logged by design, so every hostname anyone requested a certificate for is public — including internal-sounding names on a certificate's alternative name list, and hosts that were never linked from anywhere. This regularly produces the most interesting results. Passive DNS databases record resolutions observed across the internet, revealing names that once existed even if they no longer reso...

FOCA — Fingerprinting Organizations with Collected Archives — is an OSINT tool that finds documents published on a target's websites, downloads them, and extracts the metadata hidden inside. It is a reconnaissance tool, and what it reveals about most organizations is uncomfortable. Every document an organization publishes carries metadata nobody looked at. FOCA collects it at scale and assembles it into a map of the internal network and the people on it. What It Does, Step by Step Search. FOCA queries search engines for documents on a target domain, using operators equivalent to site:target.com filetype:pdf across many file types. Download. It retrieves every document it finds — PDFs, Word, Excel, PowerPoint, OpenOffice formats, and more. Extract. It parses each file's metadata. Correlate. This is the valuable part. It aggregates findings across hundreds of documents to build a picture no single file would reveal. What Comes Out Usernames. Document autho...

Crawling a website finds what it links to. Content discovery — also called forced browsing or directory brute forcing — finds what it does not: administrative paths, old versions, backup files, staging endpoints, and APIs that exist but appear in no menu. These are frequently the most interesting parts of an application precisely because nobody expected anyone to look. How it works The tool requests a long list of candidate paths and records which ones return something other than "not found." That is the entire technique. Its effectiveness comes almost entirely from three choices. The wordlist. A generic list of common directory names finds common things. A list built from the target — words scraped from the site, the organization's terminology, developer and project names, framework-specific paths once the stack is identified — finds the things specific to that application. This is where skill shows. Extensions. Requesting each word with a set of suffixes...