Study guide
5.1 Active vs Passive Reconnaissance
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
5.1 Active vs Passive Reconnaissance
Key Takeaways Explain This Topic AI
Domain 2 (Reconnaissance and Enumeration) is 21 percent of PT0-003; objective 2.1 starts with classifying a technique as passive or active before any tool flag is chosen.
Passive reconnaissance collects data without sending packets to the target: WHOIS, certificate transparency logs, search engines, cached pages, job boards, and third-party indexes such as Shodan.
Active reconnaissance touches the target: TCP/UDP scans, live banner grabs, HTML scraping of the live app, and sniffing on a segment you have joined.
Exam trap: WHOIS and CT logs are passive; a SYN scan is active even if the handshake is never completed, because the SYN still arrives.
Work the example.com pattern: gather CT hostnames and job-board stack leaks first, then SYN-scan the agreed CIDR and banner-grab 443 only after written RoE.
Last updated: August 2026
Domain 2, Reconnaissance and Enumeration , is 21 percent of CompTIA PenTest+ PT0-003 — the second-largest scored domain after Attacks and Exploits. Objective 2.1 Information Gathering is the front door of that domain: you collect facts about names, certificates, people, and packets before anyone selects an exploit. The first exam decision is not which scanner timing template to use. It is whether the technique is passive or active , because that classification decides whether you may work before the testing window, whether the client's sensors will see you, and whether the "best next step" on a multiple-choice item is a public lookup or a packet to a live host.
Passive reconnaissance gathers information without sending packets to the target systems . You query third parties and public records: WHOIS, certificate transparency (CT) logs, search engines, archived or cached pages, job boards, social media, public code repositories, and internet-wide scan indexes such as Shodan or Censys. Those queries never land on the client's web server, VPN concentrator, or jump box. Active reconnaissance sends packets, sessions, or probes that the target — or a firewall, WAF, or IDS in front of it — can observe: TCP and UDP protocol scans, banner grabs against open ports, HTML scraping of the live application, and network sniffing on a segment you have joined.
Exam trap: WHOIS and CT logs are passive. A SYN scan is active. Completing only one-third of the TCP handshake does not make a SYN scan passive; the SYN still arrived and can be logged. Shodan is usually passive from your perspective because you are reading a third party's historical scan, not scanning the host yourself. The moment you open your own TCP session to confirm that banner, the confirmation is active.
Passive versus active is not the same as quiet versus loud
Candidates mix three different axes and then miss the item.
Passive vs active — did you send packets to the target?
Stealth vs noisy — how obvious is the traffic to a defender?
Covert vs overt — does the client know a test is happening?
A slow SYN scan ( -T2 in Nmap terms, taught later with tools) is still active. An unannounced test can still start with purely passive OSINT. "Passive sniffing" in old network textbooks means capturing frames without injecting. For PT0-003, joining a client network and capturing traffic is not OSINT . You already have a presence on the wire, you needed authorization to plug in or receive a SPAN/mirror, and IoT/OT captures are in-scope only when rules of engagement say so. Do not mark a SPAN-port capture as "passive reconnaissance" just because you did not send a SYN.
What "touching the target" means for third parties
A recursive DNS lookup at 8.8.8.8 or 1.1.1.1 for www.example.com does not send your probe to the web server; it is usually treated as passive. Asking that same organization's authoritative name server for a zone transfer (AXFR) is an enumeration packet to a client-owned service and is active. Reading a CDN-cached copy of a marketing page through a search engine is passive. Requesting /admin on the live origin is active. Information disclosure is the finding class recon is hunting — extra hostnames, stack names, comments in HTML, expired certificates, leaked keys, cleartext protocols. Disclosure can be discovered passively or actively. The finding is about what leaked; the technique is about how you learned it.
Why the exam treats the split as an authorization rule
Passive collection is commonly allowed before the testing window because you are reading public records, not touching production. That is not a free pass to publish employee home addresses or to phish people you found on LinkedIn. Rules of engagement still govern how OSINT may be used . Active collection is in-scope only after the statement of work, RoE, and written authorization letter name the selectors (CIDR ranges, domains, IP addresses, URLs) and the window. An email that says "start looking at example.com" is not a license to SYN-scan every hostname a CT log ever issued for the brand.
A second reason the split matters: detection and evidence . Passive work leaves no packet on the target. Active work will, and a SOC may page the tester. That is expected on an announced test and a process failure if RoE forbade noisy scans during business hours. Log your source IPs and timestamps so the client can correlate your traffic with their alerts.
Worked scenario: the client gives you example.com
A client names example.com as the target. Until RoE is signed, stay passive.
Certificate transparency (a crt.sh-style search) lists vpn.dev.example.com and an expired certificate . The extra hostname is a candidate , not automatic scope. The expired cert is a cryptographic-hygiene lead you will confirm later against live TLS — that confirmation is active.
A job board lists "Senior Palo Alto administrator, example.com." The stack leak is OSINT. You do not scan the firewall.
WHOIS and ordinary DNS at a public recursive resolver (A, AAAA, MX, NS, TXT) expand mail hosts, SPF/DMARC, and name servers without asking the authoritative server for a zone dump.
After written RoE covers an agreed CIDR and named domains, go active: SYN-scan the CIDR, then banner-grab TCP 443 on hosts that answered. You still do not scan a payment-processor IP that merely shares a certificate SAN.
When you drill these decision rules among mixed Domain 2 items, use timed practice at /practice/pentest-plus . PT0-003 will not grade you in this chapter on memorizing twenty Nmap flags; it will ask whether the next step is a public lookup or a packet.
Classification table
Technique Packets to the client's hosts? Typical class Live RoE window required?
- WHOIS / registrar data No Passive Usually no
- Certificate transparency logs No Passive Usually no
- Search-engine analysis and cached pages No Passive Usually no
- Job boards and social media No Passive Use-of-data still in RoE
- Shodan / Censys historical data No (third party) Passive from your side Confirm before treating as current
DNS at a public recursive resolver Not to the web/VPN host Usually passive AXFR against the client's NS is different
- Zone transfer (AXFR) to the authoritative NS Yes, to the NS Active enumeration Yes
- TCP SYN or connect scan Yes Active Yes
- UDP protocol probe Yes Active Yes
- Banner grab (netcat or Nmap -sV ) Yes Active Yes
- HTML scrape of the live app Yes Active Yes
Sniffing on an in-scope IoT/OT segment You are on the wire Authorized collection, not OSINT Yes, plus OT safety
Sequencing: OSINT, reconcile, then touch
Mature engagements stay wide and quiet first. Passive OSINT builds a list. You reconcile that list with SoW selectors and exclusions. Only surviving names become active targets. That order also matches how intelligence gathering is supposed to precede exploitation in methodologies such as PTES. If a performance-based item shows a tester scanning first and googling later, the process is backwards unless RoE forbade OSINT (rare) or the clock was already inside a tight window and the client provided the CIDR up front.
Tools that implement these techniques — Nmap, Wireshark, theHarvester, Amass, Shodan — belong mainly in the later recon-tools chapter. For 2.1, name them only as context: Nmap is how many testers send the SYN; Wireshark is how they sniff; Shodan is search-engine-like internet-scan data you query without touching the host.