Domain 2 · Blueprint topic (academy numbering) 2.1 · Chapter 2 of 20
Reconnaissance and public-information footprint
About 6 minutes · EC-Council knowledge-exam blueprint v5.0; practical examination and training-version labels are separate
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Public information can reveal private structure.
Explore the anchors
Identify approved targets and questions.
Concept matching activity
Match this task or description to its concept:
Collect permitted public information.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Assessment, defenses and evidence
- Reconnaissance — deeper assessment study
Concepts and mechanisms
Reconnaissance gathers information to understand an authorized target and its possible exposure. Passive collection uses existing public or permitted records without directly testing the target’s behavior. Active collection interacts with a target or service. Passive does not mean free of privacy, licensing or legal constraints; gathering personal information still needs a legitimate engagement purpose.
Useful source categories can include organization-published information, domain and DNS records, certificate information and approved technology inventories. A domain registration or public search result may be old, inaccurate or associated with a former owner. Correlate sources and timestamps. A discovered address is a candidate asset, not proof that it is live, owned by the customer or in scope.
Assessment, defenses and evidence
Assess the exposure the evidence actually supports. A published staff role may make impersonation plausible but does not justify contacting that person outside approved social-engineering scope. Protect collected data, avoid unnecessary personal details and record provenance. Do not put confidential customer information into unapproved search or AI services.
Defenses include disciplined publication, management of abandoned assets, verified ownership, appropriate privacy settings and clear reporting channels. Public information cannot always be hidden and should not be treated as a secret authentication factor. The assessment should identify actionable exposure, not reward the largest possible collection of unrelated information.
Reconnaissance — deeper assessment study
Public research can reveal historical infrastructure, role information and email conventions. Search results, social profiles, registry records and third-party datasets differ in freshness and provenance. A DNS answer identifies a record observed at a time; it does not prove that the host is live, vulnerable or exclusively controlled by the named organization. Registry privacy or stale records can further limit attribution.
Corroborate a footprint with approved inventories and dated observations before planning active work. Minimize personal information and redact irrelevant details. Email metadata can identify service dependencies without proving mailbox compromise. AI-generated summaries of public records should preserve citations and dates; invented hostnames are hypotheses, not discovered assets. Countermeasures include reducing unnecessary disclosure, reviewing exposed records and maintaining accurate asset ownership.
Worked example
A search result lists an old support subdomain. The tester verifies ownership and scope with the customer before attempting active checks, preserving the public record’s date and uncertainty.
Check your understanding
Why should a discovered subdomain not automatically enter the active test list?
Show explanation
Its ownership, current use and authorization may differ from the apparent brand. Confirm those conditions before interacting with it.
Apply this course’s topics in the CEH evidence workbench →
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.