Overview & Rules of Engagement
Reconnaissance is split into passive and active phases. Passive collection uses public, non-interactive sources (archives, CT logs, WHOIS, passive DNS, public registries). Active scanning probes targets (port scans, service detection) and can impact availability or trigger defenses. Before any active step: obtain written permission, scope IPs/domains, set time windows, and agree on reporting and throttling. If unsure, perform only passive collection.
Always get authorization and define boundaries before any active work.