This section focuses on the very first part of a penetration test: Passive Reconnaissance. This is where you use all the tools and resources at your disposal to gather up all of the information you can on your target, without interacting with the target in anyway (no scanning).
For more tools and resources on intelligence gathering outside of the below frameworks, please see the OSINT section under Cyber Intelligence.
{% content-ref url="../../cyber-intelligence/osint/" %} osint {% endcontent-ref %}
{% content-ref url="../offensive-toolbox/recon-frameworks.md" %} recon-frameworks.md {% endcontent-ref %}
{% content-ref url="../../web-app-hacking/mapping-the-site.md" %} mapping-the-site.md {% endcontent-ref %}
{% hint style="info" %} Note: Many Recon Frameworks have both passive and active reconnaissance capabilities. {% endhint %}
- https://tryhackme.com/room/passiverecon
- https://tryhackme.com/room/redteamrecon
- Penetration Testing: Information Gathering - pg.113
{% content-ref url="exploit-research.md" %} exploit-research.md {% endcontent-ref %}
{% content-ref url="exploitation.md" %} exploitation.md {% endcontent-ref %}
{% content-ref url="payloads-and-obfuscation/" %} payloads-and-obfuscation {% endcontent-ref %}
{% content-ref url="exploit-dev-buffer-overflow.md" %} exploit-dev-buffer-overflow.md {% endcontent-ref %}
- Penetration Testing: Post Exploitation - pg.277
{% content-ref url="post-exploitation/enumeration-and-harvesting.md" %} enumeration-and-harvesting.md {% endcontent-ref %}
{% content-ref url="network-attacks-harvesting-mitm.md" %} network-attacks-harvesting-mitm.md {% endcontent-ref %}
{% content-ref url="post-exploitation/privilege-escalation.md" %} privilege-escalation.md {% endcontent-ref %}
{% content-ref url="active-directory.md" %} active-directory.md {% endcontent-ref %}
{% content-ref url="post-exploitation/persistence.md" %} persistence.md {% endcontent-ref %}
{% content-ref url="file-transfer.md" %} file-transfer.md {% endcontent-ref %}
{% content-ref url="lateral-movement.md" %} lateral-movement.md {% endcontent-ref %}
{% content-ref url="pivot-proxy-tunnel-redirect.md" %} pivot-proxy-tunnel-redirect.md {% endcontent-ref %}
{% content-ref url="post-exploitation/defense-evasion.md" %} defense-evasion.md {% endcontent-ref %}
{% content-ref url="password-attacks.md" %} password-attacks.md {% endcontent-ref %}
{% content-ref url="../../cloud.md" %} cloud.md {% endcontent-ref %}
{% content-ref url="../../containers.md" %} containers.md {% endcontent-ref %}
{% content-ref url="special-targets.md" %} special-targets.md {% endcontent-ref %}