What is passive reconnaissance?
Passive reconnaissance is the information-gathering stage of an attack or penetration test in which nothing is sent to the target's own systems. The researcher reads what is already public or held by third parties: registration databases, search results, news, social media and data others have published. Most of it is open-source intelligence (OSINT).
What makes it passive
The test is one question: did any traffic reach a system the target owns or runs? Looking up a domain in a public WHOIS database, querying a public DNS resolver, reading the company's job postings and searching certificate transparency logs all go to third parties, so they are passive. Browsing the target's public website is a gray area; it looks like ordinary visitor traffic, but strictly it touches the target. Anything that probes the target, such as a ping sweep or a port scan, is active.
What it reveals
- Domain names, subdomains and hosting providers
- Staff names, roles and the email address format
- Technologies in use, often named in job ads or engineers' profiles
- Office locations, partners and suppliers
- Credentials or secrets exposed in old breaches or public code repositories
Why defenders care
Since no traffic reaches the target, passive reconnaissance leaves nothing in the target's logs. Defenders cannot block it; they can only shrink what it finds. Common steps are registration privacy for domains, job ads that avoid naming specific security products, OPSEC training about what staff post, scanning public repositories for leaked secrets, and repeating the same research against their own organization now and then to see what an attacker would see.
Passive vs. active reconnaissance
| Passive | Active | |
|---|---|---|
| Touches target systems | No | Yes |
| Detectable by the target | Very hard | Often, in firewall and IDS logs |
| Precision | Suggests what may exist | Confirms what is running |
| Examples | WHOIS, public DNS, job postings | Ping sweeps, port scans, banner grabbing |
Passive reconnaissance on the CompTIA Security+ exam
SY0-801 objective 5.5 divides penetration test reconnaissance into passive and active. Scenario wording about public records, social media, search engines, WHOIS lookups or reading job postings points to passive reconnaissance. A scan described as slow or quiet is still active, because traffic reached the target, and that is the most common trap. OSINT is a close distractor: it names the kind of information, while passive reconnaissance names the activity of collecting it without contact. OSINT also appears under objective 2.1 as a threat intelligence source.