Reconnaissance & OSINT
Part of the Cybersecurity Roadmap
In short
Before any active testing, authorised testers map what is already public about a target. The same view helps defenders see what they are accidentally exposing to the world.
Gathering publicly available information about a target before any active testing — Open Source Intelligence techniques reveal exposed employee info, technology stacks, and misconfigured public assets.
Think of it like this
Reading a company's public noticeboard
Before visiting a big office, you might read its website, its job ads and its public notices to learn how it works. None of that is sneaky; it is all out in the open. OSINT is gathering that public information in an organised way.
Watch it happen
From public data to a defence task
1/4Open sources: the website, job posts, public records and leaked breach lists.
The big ideas
What you need to know
OSINT is open and legal
Open Source Intelligence uses only public information. Gathering it is legal; how you later use it must still be authorised.
You leak more than you think
Job ads reveal your tech stack, and old subdomains linger. Defenders should regularly check their own exposure.
People are in scope too
Reused passwords from old breaches are a common way in. This is why breach monitoring and unique passwords matter.
It guides the whole test
Good recon shapes everything after it, so testers do it carefully and stay strictly inside the agreed scope.
Save yourself the pain
Common mistakes
Oops
Thinking because data is public, any use of it is fine.
Do this instead
Gathering public data is legal, but acting on it against a system still needs authorisation and scope.
Oops
As a defender, ignoring your own public footprint.
Do this instead
Search what the internet knows about you: old subdomains, leaked emails, exposed documents. Then reduce it.
Your mission
Audit your own footprint
Quick check
What does OSINT rely on?
Go deeper
- 1Practice OSINT techniques on a legal target (like your own organization or a designated practice target).
- 2Learn to use tools like Shodan or similar to find exposed services (on authorized targets only).
- 3Understand passive reconnaissance (no direct contact) versus active reconnaissance (direct probing).
More topics at this stop
Penetration Testing Methodology
Scanning & Enumeration (Nmap)
Exploitation Basics
Metasploit Framework
Burp Suite Fundamentals
Privilege Escalation
Post-Exploitation Basics
Password Attacks & Cracking
Wireless Security Testing (Overview)
Report Writing for Pentests
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
