Study guide
7.2 Recon and Enumeration Tools
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
7.2 Recon and Enumeration Tools
Key Takeaways Explain This Topic AI
Objective 2.4 is a matching exam: pick the named tool for the job, not a flag list. Domain 2 is still 21 percent of PT0-003.
OSINT graphs are Maltego, SpiderFoot, and Recon-ng; OSINTframework.com is a directory of sources, not a scanner.
Shodan and Censys.io are third-party internet-wide indexes (passive from your side); Nmap with NSE is your scan of in-scope hosts after RoE.
DNS uses WHOIS, nslookup/dig, DNSdumpster, and Amass; people and email use Hunter.io and theHarvester; historical pages use the Wayback Machine.
Wireless recon is WiGLE.net, InSSIDer, and Aircrack-ng capture/identify (attacks are Domain 4.7); packets are Wireshark or tcpdump. Traps: Shodan vs Nmap, Maltego vs theHarvester, dig vs Nmap.
Last updated: August 2026
Objective 2.4 is Given a scenario, use the appropriate tools for reconnaissance and enumeration . After 2.1 (what to collect), 2.2 (what to inventory), and 2.3 (how to glue it with a script), PT0-003 becomes a matching exam : which named tool does this job. You do not need every flag. You need the job-to-tool mapping, plus three traps that recycle every sitting: Shodan versus Nmap , Maltego versus theHarvester , and dig versus Nmap .
Work example.com the same way as earlier Domain 2 chapters. Confirm RoE selectors first. Then pick the tool that matches the data type the stem wants — historical pages, DNS, people, wireless identifiers, packets, third-party internet indexes, or live ports on in-scope hosts. A 2.3 Bash loop that calls dig is still a dig question if the stem asks which tool answered the MX record. A Python requests wrapper around a Shodan API is still Shodan if the stem asks where the banner came from.
OSINT graphs and the framework index
Maltego is the graph. Transforms turn a domain, email, or IP into linked entities you can see: name servers, people, netblocks, documents. Use it when the stem asks you to visualize relationships , not when it only asks you to dump a list of mailboxes.
SpiderFoot automates OSINT modules against a target and aggregates the results into one report. Recon-ng is a modular, Metasploit-like CLI workspace: set a domain, run recon modules, store results in a workspace database. Both are "run many OSINT sources from one console." They are not packet captures, and they are not Nmap.
OSINTframework.com is not a scanner. It is a directory of OSINT resources you browse to choose the next source (search engines, leaked-data sites, geospatial tools, and so on). If the item says "which site lists OSINT tools by category," that is OSINTframework.com, not Shodan and not Nmap.
Exam trap: Maltego graphs; theHarvester lists . If the stem wants harvested emails, do not pick Maltego just because both are "OSINT." If the stem wants a relationship picture for example.com, do not pick theHarvester just because it can also see names.
Internet-wide indexes versus you scanning
Shodan and Censys.io search third-party internet-wide scan data : banners, certificates, and services already observed by someone else's scanners. Querying them is passive from your side — no SYN packet to the client's host. Use them to learn what the internet already knows about example.com: an exposed admin panel on a forgotten host, a certificate SAN list, an outdated banner.
Nmap , including NSE (the Nmap Scripting Engine), is you scanning in-scope hosts . NSE scripts add version checks, default-script ( -sC ) enumeration, and protocol helpers (SMB, HTTP, DNS, and others listed in the script help). If the RoE window is open and the stem needs current open ports on the agreed CIDR, the answer is Nmap, not Shodan. NSE is still Nmap. Do not pick Recon-ng because the word "script" appeared.
Exam trap: Shodan is not your in-scope scan
Shodan is third-party internet data. Nmap is your scan of in-scope hosts. A stale Shodan banner is not proof tcp/22 is still open today. Nmap against addresses that are not in the SoW is an authorization failure even if Shodan already listed them. Censys.io is in the same family as Shodan: an index you query, not a substitute for the in-window scan. If the stem says "do not send packets to the target" and still wants service banners, pick Shodan or Censys. If the stem says "confirm live ports during the testing window," pick Nmap.
DNS, registration, and name discovery
WHOIS returns registrar, registrant (where not redacted), name servers, creation dates, and netblock contact data. It is a registration lookup, not a port scan. It does not list every subdomain Amass would find.
nslookup and dig are local DNS query tools: A, AAAA, MX, NS, TXT, PTR. dig is the Linux-favored, scriptable choice (easy to drop into a Bash loop from 2.3). nslookup still appears on Windows. Neither tool SYN-scans ports. A dig example.com MX answer names a mail host; it does not prove tcp/25 is open.
DNSdumpster is a web OSINT view of a domain's DNS footprint — records, related hosts, and a map. Amass performs attack-surface mapping and subdomain discovery across many sources. Used passively, it stays in 2.1-style OSINT; if you enable active collection, you are touching target infrastructure and need RoE. Use Amass when the stem wants a large subdomain inventory, not a single A record. Use dig when the stem wants one record type from a resolver you control.
Exam trap: dig answers a DNS question. Nmap answers a port and service question. Do not pick Nmap to "see the MX record." Do not pick dig to "confirm which TCP ports are open on the mail host." WHOIS is not Amass: registration metadata versus name inventory.
People, email, and historical pages
Hunter.io finds email addresses and patterns for a domain (often first.last@example.com ) and is the usual pick when the stem is specifically email-pattern OSINT for pretext recon (still recon, not the Domain 4.8 send). theHarvester collects emails, names, subdomains, and hosts from search engines and other public sources in one pass. Pick theHarvester when the stem wants a broad harvest from multiple public sources, not a relationship graph. Pick Hunter.io when the stem is the mailbox pattern itself.
Wayback Machine (Internet Archive) retrieves historical snapshots of pages: old JavaScript endpoints, retired subdomains, forgotten admin paths, last year's privacy policy that still listed an internal hostname. It is passive. It is not a live crawler of today's application — live crawling was 2.2. It is not Nmap -sV against the current virtual host.
Wireless recon: identify, do not attack
WiGLE.net is a wardriving database: historical SSID, BSSID, and GPS observations other people uploaded. InSSIDer is a local Wi-Fi discovery GUI: which SSIDs, BSSIDs, channels, and strengths you see from the parking lot or the authorized floor.
Aircrack-ng appears on the official 2.4 list as a recon tool: capture and identify wireless networks (monitor mode, airodump-ng -style inventory of SSIDs and clients). Full wireless attacks — deauthentication, evil twin, cracking a handshake as an attack — live in Domain 4.7 . If the stem only asks you to identify nearby BSSIDs before the attack phase, stay with WiGLE.net, InSSIDer, or Aircrack-ng in capture-and-identify mode. Do not pick WHOIS to "resolve an SSID," and do not pick Shodan as the campus Wi-Fi sniffer.
Packets on the wire
Wireshark is the GUI packet analyzer. tcpdump is the CLI capture tool on Linux (easy to call from a Bash recon script). Use them to inspect DNS queries, HTTP Host headers, TLS handshakes, and mis-aimed broadcasts on a segment you are authorized to join. They are not subdomain enumerators, not email harvesters, and not internet-wide indexes. If the stem is "see which names the workstation is resolving right now," pick Wireshark or tcpdump, not Amass. If the stem is "build a subdomain wordlist from public sources," pick Amass or theHarvester, not tcpdump.
Worked walkthrough: example.com tool order
Client names example.com. Passive first: WHOIS for registrar and NS, dig / nslookup for MX and TXT, DNSdumpster or Amass for a name inventory, Wayback Machine for old admin paths, Shodan or Censys.io for what the internet already observed, Hunter.io or theHarvester for people, Maltego (or SpiderFoot / Recon-ng) if leadership wants a graph, OSINTframework.com if you forgot which OSINT source exists. After written RoE: Nmap with NSE on the agreed CIDR, Wireshark or tcpdump on the authorized span, InSSIDer, WiGLE.net, or Aircrack-ng identify for campus SSIDs. If you Nmap first because Shodan existed, you skipped 2.1 sequencing. If you treat Shodan as the in-window port list, you fail the 2.4 trap. If you pick theHarvester when the screenshot is a Maltego graph, you fail the people-versus-graph trap. If you pick Nmap when the question is an MX record, you fail the dig-versus-Nmap trap.
Tool-to-job table
- Tool Job on PT0-003 Typical data
- Wayback Machine Historical page snapshots Old URLs, JS, retired hosts
- Maltego OSINT relationship graph Linked entities from transforms
- SpiderFoot Automated OSINT aggregation Multi-source target report
- Recon-ng Modular OSINT workspace Module results in a workspace
- OSINTframework.com Directory of OSINT resources Tool/source index, not a scan
- Shodan Third-party internet-wide index Historical banners and services
- Censys.io Third-party internet-wide index Certificates, hosts, observed services
- WHOIS Registration lookup Registrar, NS, contacts, netblock
- nslookup / dig Local DNS queries A, AAAA, MX, NS, TXT, PTR
- DNSdumpster Web DNS OSINT footprint Records, related hosts, map
- Amass Attack-surface / subdomain mapping Large name inventory
- Nmap (NSE) Your scan of in-scope hosts Live ports, scripts, versions
- Hunter.io Email-pattern OSINT Addresses and naming pattern
- theHarvester Broad public harvest Emails, names, hosts, subdomains
- WiGLE.net Historical wardrive maps SSID, BSSID, GPS observations
- InSSIDer Local Wi-Fi discovery SSIDs, channels, strength
- Aircrack-ng (here) Capture and identify Wi-Fi Nearby networks and clients
- Wireshark / tcpdump Packet capture and analysis DNS, HTTP, TLS on the wire
- Matching traps to memorize
- Stem wants Pick Do not pick
- Current ports on the in-scope CIDR Nmap + NSE Shodan or Censys as "the scan"
- What the internet already observed Shodan or Censys.io Nmap against out-of-scope space
- Relationship graph Maltego theHarvester as a graph
- Email or name harvest theHarvester or Hunter.io Maltego as a mailbox dump
- One DNS record dig or nslookup Nmap
- Subdomain attack surface Amass or DNSdumpster Wireshark
- Old website copy Wayback Machine Live Nmap -sV
- SSID / BSSID inventory WiGLE.net, InSSIDer, or Aircrack-ng identify WHOIS
- Packets on an authorized segment Wireshark or tcpdump Recon-ng
- "Where do I look up OSINT tools?" OSINTframework.com Shodan
Memorize the job, then the name. PT0-003 will not grade you in 2.4 on writing a new NSE script from scratch. It will ask whether the next click is Wayback, Maltego, Shodan, dig, Nmap, or a wireless identifier — and whether that click stays inside RoE.