Reconnaissance

Definition

Reconnaissance is the stage of a cyber attack where an attacker gathers information about a target before attempting to break in. The goal is to learn how systems are set up, who uses them, and where weaknesses might exist. This helps the attacker plan the rest of the operation with minimal noise or mistakes.

In the Cyber Kill Chain model, reconnaissance is the first step. It comes before weaponization, delivery, exploitation, and the other stages of an attack. During reconnaissance, the attacker studies the target from a distance and avoids doing anything that would reveal their presence.

Common reconnaissance activities include:

* Scanning the network to find open ports and internet-facing services
* Searching for outdated software that might contain known vulnerabilities
* Reviewing public information such as websites, social media, and job postings
* Gathering usernames, email addresses, and other identity clues
* Testing how the organization responds to unusual requests or login attempts

Example: An attacker searches LinkedIn to identify key employees, uses a scanner to find a web server that is running outdated software, and checks for pages that return errors that suggest hidden admin functionality.

Reconnaissance does not cause direct damage, but it provides the knowledge needed to carry out exploitation later in the Kill Chain. Organizations that monitor and reduce publicly exposed information can make reconnaissance more difficult, which reduces the attacker’s chance of success in the later stages of an intrusion.

Explore More Terms

Practice in These Games

A Rap Beef: An Intro to Security Investigations

Great for first time KC7 Players! You don't need any cybersecurity experience to do this module! 🥳 First time? This is the perfect place to start! Two hip-hop artists are in the midst of a musical ...

View Game