19.1 Passive vs Active Recon

By Ravindra Bagale Last updated: 27 September 2026

Recon che don prakar aahet. Passive recon mhanje target la direct touch na karta mahiti kadhne – public records, whois, search engines, certificate logs, social media. Active recon mhanje target la packets pathvne – ping, port scan, banner grab, DNS queries direct target chya server la. Passive shant aste, active logs madhe disto. He farak khup important aahe, dhyan rakho.

	Passive recon	Active recon
Touches the target?	No (third-party sources)	Yes (packets reach the target)
Examples	whois, public search, theHarvester (search sources), Maltego	Netdiscover (active mode), Nmap, Masscan, zone transfer attempts
Detectable by target?	Mostly no	Yes – firewall, IDS and server logs
Needs permission?	In a real engagement: yes, it is part of the scope	Always, in writing
Risk to target	None	Low, but aggressive scans can crash fragile services

In a real test the order is usually: passive first (build a picture quietly), then active (confirm what is live and what is running). The output of recon is a simple asset list: domains, subdomains, IPs, open ports, services and versions. Every later phase – vulnerability scanning, web testing, exploitation – starts from that list.

Some tools are both: theHarvester is passive when it queries search sources, but active when you ask it to brute-force DNS against the target's own name server. Always ask yourself: "Is my packet reaching the target right now?"

Why this matters for security

Defenders cannot see passive recon, so the only defence is to publish less: minimal whois data, no internal hostnames in public DNS, no staff lists and tech stacks on job posts. Active recon, on the other hand, leaves traces – and most of this chapter's 19.10 is about catching it early, because scanning is often the first visible sign of an attack.

Ravindra Bagale's Tip

Many students think "it's passive, so the law doesn't apply". Wrong! Even passive OSINT against a real company must be written into the engagement's scope. And the second mistake – once you send a DNS query to the target's own server, it has become active. Always ask: is my packet reaching the target?

Practice task

Make a two-column table in your notes titled "Passive / Active". Put every tool from this chapter's objectives into one column (some go in both, with a note on when). Keep it – you will add the defence for each tool in 19.10.