What it means
Passive sources can reveal domains, technologies, employees, repositories, and exposed metadata. Active methods query systems and may create logs or operational effects.
Why it matters
Careful reconnaissance improves test quality and helps defenders understand what an external observer can learn before exploitation.
Practical focus
- Separate passive and active collection
- Validate ownership before touching discovered assets
- Record source and confidence for findings
- Use discovered context to refine safe testing
Common mistakes
- Scanning every discovered system without authorization
- Assuming public information is harmless
- Collecting data without linking it to an objective
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: