5.1 Active vs Passive Reconnaissance

Domain 2, Reconnaissance and Enumeration, is 21 percent of CompTIA PenTest+ PT0-003 — the second-largest scored domain after Attacks and Exploits. Objective 2.1 Information Gathering is the front door of that domain: you collect facts about names, certificates, people, and packets before anyone selects an exploit. The first exam decision is not which scanner timing template to use. It is whether the technique is passive or active, because that classification decides whether you may work before the testing window, whether the client's sensors will see you, and whether the "best next step" on a multiple-choice item is a public lookup or a packet to a live host.

Passive reconnaissance gathers information without sending packets to the target systems. You query third parties and public records: WHOIS, certificate transparency (CT) logs, search engines, archived or cached pages, job boards, social media, public code repositories, and internet-wide scan indexes such as Shodan or Censys. Those queries never land on the client's web server, VPN concentrator, or jump box. Active reconnaissance sends packets, sessions, or probes that the target — or a firewall, WAF, or IDS in front of it — can observe: TCP and UDP protocol scans, banner grabs against open ports, HTML scraping of the live application, and network sniffing on a segment you have joined.

Exam trap: WHOIS and CT logs are passive. A SYN scan is active. Completing only one-third of the TCP handshake does not make a SYN scan passive; the SYN still arrived and can be logged. Shodan is usually passive from your perspective because you are reading a third party's historical scan, not scanning the host yourself. The moment you open your own TCP session to confirm that banner, the confirmation is active.

Passive versus active is not the same as quiet versus loud

Candidates mix three different axes and then miss the item.

• Passive vs active — did you send packets to the target?
• Stealth vs noisy — how obvious is the traffic to a defender?
• Covert vs overt — does the client know a test is happening?

A slow SYN scan (-T2 in Nmap terms, taught later with tools) is still active. An unannounced test can still start with purely passive OSINT. "Passive sniffing" in old network textbooks means capturing frames without injecting. For PT0-003, joining a client network and capturing traffic is not OSINT. You already have a presence on the wire, you needed authorization to plug in or receive a SPAN/mirror, and IoT/OT captures are in-scope only when rules of engagement say so. Do not mark a SPAN-port capture as "passive reconnaissance" just because you did not send a SYN.

What "touching the target" means for third parties

A recursive DNS lookup at 8.8.8.8 or 1.1.1.1 for www.example.com does not send your probe to the web server; it is usually treated as passive. Asking that same organization's authoritative name server for a zone transfer (AXFR) is an enumeration packet to a client-owned service and is active. Reading a CDN-cached copy of a marketing page through a search engine is passive. Requesting /admin on the live origin is active. Information disclosure is the finding class recon is hunting — extra hostnames, stack names, comments in HTML, expired certificates, leaked keys, cleartext protocols. Disclosure can be discovered passively or actively. The finding is about what leaked; the technique is about how you learned it.

Why the exam treats the split as an authorization rule

Passive collection is commonly allowed before the testing window because you are reading public records, not touching production. That is not a free pass to publish employee home addresses or to phish people you found on LinkedIn. Rules of engagement still govern how OSINT may be used. Active collection is in-scope only after the statement of work, RoE, and written authorization letter name the selectors (CIDR ranges, domains, IP addresses, URLs) and the window. An email that says "start looking at example.com" is not a license to SYN-scan every hostname a CT log ever issued for the brand.

A second reason the split matters: detection and evidence. Passive work leaves no packet on the target. Active work will, and a SOC may page the tester. That is expected on an announced test and a process failure if RoE forbade noisy scans during business hours. Log your source IPs and timestamps so the client can correlate your traffic with their alerts.

Worked scenario: the client gives you example.com

A client names example.com as the target. Until RoE is signed, stay passive.

1. Certificate transparency (a crt.sh-style search) lists vpn.dev.example.com and an expired certificate. The extra hostname is a candidate, not automatic scope. The expired cert is a cryptographic-hygiene lead you will confirm later against live TLS — that confirmation is active.
2. A job board lists "Senior Palo Alto administrator, example.com." The stack leak is OSINT. You do not scan the firewall.
3. WHOIS and ordinary DNS at a public recursive resolver (A, AAAA, MX, NS, TXT) expand mail hosts, SPF/DMARC, and name servers without asking the authoritative server for a zone dump.

After written RoE covers an agreed CIDR and named domains, go active: SYN-scan the CIDR, then banner-grab TCP 443 on hosts that answered. You still do not scan a payment-processor IP that merely shares a certificate SAN.

/practice/pentest-plusPractice questions with detailed explanations

Classification table

Sequencing: OSINT, reconcile, then touch

Mature engagements stay wide and quiet first. Passive OSINT builds a list. You reconcile that list with SoW selectors and exclusions. Only surviving names become active targets. That order also matches how intelligence gathering is supposed to precede exploitation in methodologies such as PTES. If a performance-based item shows a tester scanning first and googling later, the process is backwards unless RoE forbade OSINT (rare) or the clock was already inside a tight window and the client provided the CIDR up front.

Tools that implement these techniques — Nmap, Wireshark, theHarvester, Amass, Shodan — belong mainly in the later recon-tools chapter. For 2.1, name them only as context: Nmap is how many testers send the SYN; Wireshark is how they sniff; Shodan is search-engine-like internet-scan data you query without touching the host.