Passive reconnaissance is an attempt to gather information about targeted computers and networks without actually communicating with them. The term originated from the military, which does passive reconnaissance before embarking on an information-gathering mission. Instead of attacking right away, they first obtain the necessary information to direct their strategies. Today, passive reconnaissance has become the first step hackers take before exploiting system or network vulnerabilities.
Think of passive reconnaissance as stalking someone on social media. While you’re not necessarily talking directly to your subject, you are actively seeking information on him/her.
Other interesting terms…
Read More about “Passive Reconnaissance”
Passive reconnaissance is part of the pre-attack phase for hackers. Attackers first “get to know” their targets to ensure that they have all the relevant information to make their attacks successful. They can do so by gathering intelligence in two ways―passive or active reconnaissance. Let’s learn how these differ below.
What’s the Difference between Active and Passive Reconnaissance?
Penetration testing requires both active and passive reconnaissance. Passive reconnaissance ensues without alerting the target. Attackers commonly employ this method to prevent their intended victim from strengthening its security measures, which could drastically affect their approach.
In contrast, active reconnaissance requires hackers to engage with the target system or network. They do so to scan for open ports that can serve as attack entry points. They may thus carry out manual testing or automated scanning using several tools. Active recon is much riskier because the chance of getting caught by a firewall or security solution is higher. But many still do active recon to improve attack accuracy.
Both attackers and victims employ both reconnaissance types. Their goals differ, though. While hackers research their targets to launch more successful attacks, ethical hackers do passive and active reconnaissance to identify system and network weaknesses to address problems before affected devices succumb to real attacks.
Top 3 Tools Used in Passive Reconnaissance
Some of the available recon tools that ethical hackers use are:
Wireshark
This network traffic analysis tool is a must-have for any ethical hacker. It helps penetration testers gain insights on the target network. They can eavesdrop on particular traffic and analyze it by mapping IP addresses with their owners and identifying their primary purpose.
As the most widely used search engine, Google provides vital information about a particular target. Hackers can use it to research a specific company. They can look into its career page and identify the systems in their networks based on detailed descriptions of job requirements.
Hackers who know how to conduct specialized searches, such as Google Dorking (i.e., using Google and other applications to identify security gaps in computer code and configurations), may uncover files that are not for public consumption.
Shodan
This tool can be considered a search engine for all devices connected to the Internet. With the ubiquity of the Internet of Things (IoT), many organizations and individuals may unknowingly expose themselves through smart devices. Shodan lets hackers find unprotected devices anywhere on the Web.
Keep in mind that most IoT devices only have basic protection. As such, hackers can quickly identify the networks these are connected to and even use them as entry points for future attacks.
These tools make a hacker’s job more manageable. When used appropriately, they can provide hackers, good or bad alike, unfortunately, the information they need to identify exploitable loopholes in any connected environment.
—
Network reconnaissance is a critical aspect of hacking. As much as possible, malicious hackers would try to obtain bits of information about targets. And while active recon may be more easily identified, passive reconnaissance allows attackers to remain hidden until they’ve gotten what they came for.
