PenTest+ · Domain 2 of 5

PenTest+ Domain 2: Reconnaissance and Enumeration

Reconnaissance and Enumeration covers gathering information and mapping the target: passive and active recon, OSINT, service and host enumeration, scripting to automate it, and the tools that do the work. Good recon shapes every attack that follows.

Exam weight
21%
Official objectives
4
Estimated questions estimate
~19
Suggested study time estimate
25–30 hrs

About 12 min read Reviewed October 2026

Overview

Domain 2 covers the information-gathering phases. It starts with information gathering techniques: active and passive reconnaissance, OSINT from social media, job boards, code repositories, DNS, cached pages, cryptographic flaws and password dumps, network reconnaissance, protocol scanning, certificate transparency logs, information disclosure, search engine analysis, network sniffing including IoT and OT protocols, banner grabbing and HTML scraping. It covers enumeration techniques: OS fingerprinting, service discovery, protocol, DNS, directory, host and share enumeration, local user and email enumeration, wireless and permission enumeration, secrets enumeration, attack path mapping, WAF enumeration, web crawling and manual enumeration. It covers modifying scripts for recon in Bash, Python and PowerShell, and using tools such as the Wayback Machine, Maltego, Recon-ng, Shodan, Amass, Nmap and theHarvester.

This domain feeds everything after it. What you find here decides the vulnerabilities analyzed in Domain 3 and the attacks launched in Domain 4.

How it's tested

Expect scenarios and performance-based items showing tool output, scan commands or OSINT results, asking which technique is passive or active, which tool to use, or what the output reveals. You may be asked to complete or correct a short recon script.

  • Passive or active

    A technique is described, and you must classify it as passive or active, often to preserve stealth or stay within rules.

  • Right tool

    An information-gathering goal is described, such as subdomain discovery, exposed devices or email harvesting, and you must pick the tool.

  • Read or fix the output or script

    Nmap output, a scan command or a short script is shown, and you must interpret it or correct it.

Reasoning it through

A tester must map a target's external footprint without alerting its security team. Running an aggressive Nmap scan is tempting for completeness, but it is active and noisy. Passive techniques, such as certificate transparency logs, DNS records, Shodan and the Wayback Machine, reveal subdomains and exposed services without sending traffic to the target, which fits the stealth requirement.

Objectives 4

Official objectives from the CompTIA outline, in outline order.

2.1 Given a scenario, apply information gathering techniques.Active and passive recon, OSINT, network recon, protocol scanning, certificate logs and sniffing.
What it means
This covers active versus passive reconnaissance, OSINT (social media, job boards, code repositories, DNS lookups and reverse lookups, cached pages, cryptographic flaws, password dumps), network reconnaissance, TCP and UDP protocol scanning, certificate transparency logs, information disclosure, search engine enumeration, network sniffing including IoT and OT protocols, banner grabbing and HTML scraping.
What to understand
Passive techniques gather information without interacting directly with the target, so they are stealthy and low-risk. Active techniques send traffic and can be detected. Certificate transparency logs and DNS records reveal subdomains and infrastructure passively. Code repositories and password dumps often expose secrets and credentials.
How it shows up
A stealth requirement or an information goal is given, and you must choose a passive or active method or the right OSINT source.
Common confusion
Calling DNS zone transfers or active scans passive. Querying public certificate logs is passive, but probing the target's own services is active.
2.2 Given a scenario, apply enumeration techniques.OS fingerprinting, service, protocol, DNS, directory, host, share, user and secrets enumeration, attack path mapping and web crawling.
What it means
Enumeration digs into discovered systems: OS fingerprinting, service discovery, protocol, DNS, directory, host and share enumeration, local user and email account enumeration, wireless and permission enumeration, secrets enumeration (cloud access keys, passwords, API keys, session tokens), attack path mapping, WAF enumeration including finding the origin address, web crawling and manual enumeration of robots.txt, sitemaps and platform plugins.
What to understand
Enumeration turns a list of live hosts into a detailed picture of services, users, shares and secrets to target. Finding a WAF's origin IP can let an attacker bypass the WAF entirely. Exposed secrets such as API keys and tokens are often the fastest path to compromise. Attack path mapping connects findings into a route to the goal.
How it shows up
A discovered service or exposed artifact is described, and you must choose the enumeration technique or interpret what it reveals.
Common confusion
Treating reconnaissance and enumeration as the same. Recon finds what exists, and enumeration extracts detailed, often authenticated-looking information from it.
2.3 Given a scenario, modify scripts for reconnaissance and enumeration.Information gathering and data manipulation in Bash, Python and PowerShell.
What it means
This covers reading and modifying scripts in Bash, Python and PowerShell for information gathering and data manipulation, using logic constructs such as loops, conditionals, Boolean, string and arithmetic operators, and using libraries, functions and classes.
What to understand
You are expected to read a script, understand what it does, and make small changes, such as adjusting a loop, a target list or an output format. You do not need to write complex programs. Recognizing what a line does and spotting an error is the key skill.
How it shows up
A short script is shown, and you must predict its output, fill in a blank, or fix a bug such as a wrong loop bound or variable.
Common confusion
Assuming you must write scripts from scratch. The objective is modifying and understanding existing ones.
2.4 Given a scenario, use the appropriate tools for reconnaissance and enumeration.Wayback Machine, Maltego, Recon-ng, Shodan, Amass, Nmap, theHarvester and others.
What it means
The tools listed include the Wayback Machine, Maltego, Recon-ng, Shodan, SpiderFoot, WHOIS, nslookup and dig, Censys.io, Hunter.io, DNSdumpster, Amass, Nmap with the Nmap Scripting Engine (NSE), theHarvester, WiGLE.net, inSSIDer, the OSINT framework, Wireshark and tcpdump, and Aircrack-ng.
What to understand
Match the tool to the job. Shodan and Censys find internet-exposed devices and services, Amass and DNSdumpster map DNS and subdomains, theHarvester and Hunter.io gather emails, Maltego and Recon-ng link OSINT data, Nmap discovers and fingerprints hosts and services, and Wireshark and tcpdump capture traffic. WiGLE, inSSIDer and Aircrack-ng cover wireless.
How it shows up
A goal is described and you must choose the tool, or output from one of these tools is shown for interpretation.
Common confusion
Using Nmap for passive OSINT. Nmap actively probes targets, while Shodan and certificate logs return existing data without touching them.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Passive vs. active reconnaissance

    Passive gathers information without directly contacting the target. Active sends traffic to it.

    Remember
    Passive is stealthier and lower-risk. Active is more detailed but detectable.
    Tested as
    Classification and stealth questions.
    Trap
    Calling direct scans passive.

  • Certificate transparency logs

    Public logs of issued TLS certificates.

    Remember
    They reveal subdomains passively.
    Tested as
    Passive recon questions.
    Trap
    Thinking subdomain discovery always requires scanning.

  • OSINT from code and dumps

    Public code repositories and breach dumps often expose secrets and credentials.

    Remember
    Check repositories for committed keys and passwords.
    Tested as
    Information gathering questions.
    Trap
    Overlooking developer leaks.

  • OS fingerprinting

    Identifying a target's operating system from its responses.

    Remember
    It guides exploit selection later.
    Tested as
    Enumeration questions.
    Trap
    Confusing it with service version detection.

  • Secrets enumeration

    Finding exposed cloud keys, passwords, API keys and session tokens.

    Remember
    Exposed secrets are often the fastest route to compromise.
    Tested as
    Enumeration questions.
    Trap
    Treating secrets as a post-exploitation-only concern.

  • WAF origin discovery

    Finding the real server IP behind a web application firewall.

    Remember
    Reaching the origin directly can bypass the WAF.
    Tested as
    Web enumeration questions.
    Trap
    Assuming a WAF cannot be bypassed.

  • Attack path mapping

    Connecting findings into a route from entry point to objective.

    Remember
    It turns scattered findings into a plan.
    Tested as
    Enumeration and planning questions.
    Trap
    Collecting data without mapping a path.

  • Shodan and Censys

    Search engines for internet-connected devices and services.

    Remember
    They provide exposure data passively.
    Tested as
    Tool selection questions.
    Trap
    Using active scans when passive data would do.

  • Amass and DNSdumpster

    Tools for DNS and subdomain mapping.

    Remember
    They build the external DNS footprint.
    Tested as
    Tool selection questions.
    Trap
    Using an email tool for subdomain discovery.

  • theHarvester and Hunter.io

    Tools for gathering email addresses and related OSINT.

    Remember
    Useful before phishing or password attacks.
    Tested as
    Tool selection questions.
    Trap
    Expecting them to scan networks.

  • Nmap and NSE

    Nmap discovers hosts, ports and services; the Nmap Scripting Engine extends it with scripts.

    Remember
    Nmap is active, so it can be detected.
    Tested as
    Tool and output questions.
    Trap
    Classifying Nmap as a passive tool.

  • Script modification

    Reading and adjusting Bash, Python or PowerShell for recon.

    Remember
    Understand loops, conditionals and operators well enough to fix small issues.
    Tested as
    Scripting questions.
    Trap
    Assuming you must write from scratch.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Passive vs. active reconnaissance

ConceptMeaningKey differenceCommon trap
Passive recon Gather data without directly contacting the target Stealthy and low risk of detection Including direct scans in this category
Active recon Send traffic to the target to probe it More detail, higher chance of detection Using it when the scope requires stealth

Reconnaissance vs. enumeration

ConceptMeaningKey differenceCommon trap
Reconnaissance Discovering what exists and the attack surface Breadth: finds targets Stopping at recon without enumerating detail
Enumeration Extracting detailed information from discovered systems Depth: services, users, shares, secrets Treating it as identical to recon

Shodan vs. Amass vs. theHarvester vs. Nmap

ConceptMeaningKey differenceCommon trap
Shodan or Censys Find internet-exposed devices and services Passive exposure data Expecting internal detail
Amass or DNSdumpster Map DNS and subdomains Builds the DNS footprint Using it to harvest emails
theHarvester or Hunter.io Gather emails and related OSINT People and address data Expecting network scanning
Nmap Discover and fingerprint hosts and services Active probing of the target Calling it passive

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Scan for stealth

    What candidates pick
    Run an aggressive Nmap scan to map a target quietly.
    Why it looks right
    Nmap is thorough and familiar.
    Why it's wrong
    Nmap is active and noisy. Stealthy mapping uses passive sources such as certificate logs, DNS and Shodan.

    Clue to watch for The scenario requires avoiding detection.

  2. Passive label error

    What candidates pick
    Mark a DNS zone transfer attempt as passive recon.
    Why it looks right
    DNS feels like background lookups.
    Why it's wrong
    A zone transfer actively queries the target's DNS server, so it is active.

    Clue to watch for The technique sends a request to the target's own infrastructure.

  3. Skip enumeration

    What candidates pick
    Move to attacks right after discovering live hosts.
    Why it looks right
    Finding hosts feels like enough recon.
    Why it's wrong
    Enumeration of services, shares, users and secrets is what makes attacks effective and targeted.

    Clue to watch for The question asks what to do before selecting exploits.

  4. Wrong OSINT tool

    What candidates pick
    Use theHarvester to enumerate subdomains.
    Why it looks right
    It is an OSINT tool.
    Why it's wrong
    theHarvester gathers emails and names. Subdomain mapping uses Amass, DNSdumpster or certificate logs.

    Clue to watch for The goal is subdomains or DNS, not people.

  5. Ignore the WAF origin

    What candidates pick
    Attack only the WAF-protected address.
    Why it looks right
    It is the public endpoint.
    Why it's wrong
    Finding the origin IP can bypass the WAF and reach the server directly.

    Clue to watch for A WAF is present and the origin address is mentioned.

  6. Rewrite the script

    What candidates pick
    Discard a provided script and write a new one from scratch.
    Why it looks right
    It feels more thorough.
    Why it's wrong
    The objective is to read and modify existing scripts, usually a small fix such as a loop bound or variable.

    Clue to watch for A script is provided with a small error or blank.

Answer framework

For any Domain 2 reconnaissance scenario, use these steps before choosing an answer.

  1. Check the stealth and scope requirement, and prefer passive techniques when detection must be avoided or the target is sensitive.
  2. Separate reconnaissance from enumeration, finding what exists first and then extracting detailed services, users, shares and secrets.
  3. Choose the tool that matches the exact goal, such as Shodan for exposure, Amass for subdomains, theHarvester for emails or Nmap for host and service discovery.
  4. Look for exposed secrets, misconfigurations and WAF origin addresses that create fast or stealthy paths forward.
  5. When a script is involved, read it line by line, predict its output, and make the smallest correct change rather than rewriting it.

Practice question

A penetration tester needs to discover as many of a company's external subdomains as possible without sending any traffic to the company's own servers. Which approach BEST meets this requirement?

Want more like this? The PenTest+ practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by nailing the passive-versus-active distinction, because it underlies many questions and connects to the stealth requirements in rules of engagement. List common techniques and label each.

Next, get hands-on with the core tools in a lab: Nmap for discovery and fingerprinting, Amass or DNSdumpster for subdomains, Shodan for exposure, and theHarvester for emails. Practice reading Nmap output, since performance-based questions often show it.

Then study enumeration in 2.2 in depth, because it is where recon becomes actionable. Focus on service, share, user and secrets enumeration and on WAF origin discovery. Candidates commonly underestimate secrets enumeration and attack path mapping.

For 2.3, practice reading short scripts rather than writing them. Trace loops and conditionals by hand and predict output. Afterwards, move to Domain 3, where the services and vulnerabilities you enumerate here are validated and analyzed before attack. Review missed questions by naming whether the technique was passive or active.

FAQ

How much of PenTest+ PT0-003 is Domain 2?

Reconnaissance and Enumeration is 21% of the PT0-003 exam, the second-largest domain.

What is the difference between passive and active reconnaissance?

Passive recon gathers information without directly contacting the target, so it is stealthy. Active recon sends traffic to the target and can be detected.

Is Nmap passive or active?

Active. It sends packets to discover and fingerprint hosts and services, so it can be detected by the target.

Do I need to write scripts?

You need to read and modify existing Bash, Python and PowerShell scripts, predict their output and fix small errors, not write complex programs from scratch.

Why is secrets enumeration important?

Exposed cloud keys, API keys, passwords and session tokens often give direct access, making them one of the fastest routes to compromise.

What is the difference between recon and enumeration?

Reconnaissance discovers what exists and maps the attack surface. Enumeration extracts detailed information, such as services, users, shares and secrets, from what was found.

How does Domain 2 connect to the rest of the exam?

The footprint and detail gathered here determine the vulnerabilities analyzed in Domain 3 and the attacks selected in Domain 4.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered passive and active recon, OSINT, enumeration, scripting and tooling. Test whether you can choose the right technique and tool under exam conditions.

Take the PenTest+ practice test Check your PenTest+ readiness

Keep going