Overview
Module 3 covers reconnaissance and attack surface mapping. It covers open source intelligence from public records, social media, job postings, code repositories and leaked credentials, DNS and reverse DNS enumeration, WHOIS and certificate transparency, search engine and metadata analysis, and infrastructure discovery to map domains, IP ranges, technologies and exposed services. The result is a prioritized map of the attack surface that guides the active testing in later modules.
On the CPENT range, thorough mapping is what makes later exploitation efficient: the footholds, services and trust paths you find here determine where you attack. Passive techniques gather information without touching the target, while active discovery probes it directly. A tester who maps carefully wastes less time guessing during the timed exercise.
How it's tested
CPENT is performance-based, so this module shows up as the mapping work that precedes every attack: gathering intelligence, enumerating infrastructure, and prioritizing the surface so later modules succeed. Because the exam is scored on what you achieve and document on live ranges, read each scenario for what it actually permits and reward methodical, evidence-backed work over guesswork.
-
Passive or active
You choose passive OSINT when stealth or no-contact is needed, and active discovery when more detail is required.
-
Right source
You match the intelligence goal to the source, such as certificate logs for subdomains or repositories for leaked secrets.
-
Prioritize the surface
You turn findings into a prioritized attack surface map rather than an undifferentiated list.
To map a target's external footprint without alerting it, aggressive scanning is tempting but noisy. Passive sources such as certificate transparency logs, DNS records and public repositories reveal subdomains, technologies and sometimes leaked credentials without sending traffic to the target, which fits a stealthy mapping phase and seeds the active testing that follows.
Modules 1
Official modules from the EC-Council outline, in outline order.
3.1 Open Source Intelligence (OSINT) and Attack Surface MappingThis module covers gathering public information about a target and mapping its attack surface: OSINT sources, DNS and in
- What it means
- OSINT gathers public information and maps the attack surface. It covers passive and active reconnaissance, DNS and WHOIS enumeration, certificate transparency, search engine and metadata analysis, repository and credential-dump discovery, and infrastructure mapping of domains, IPs, technologies and services.
- What to understand
- Passive reconnaissance avoids contacting the target and is stealthy; active discovery probes directly and is detectable. Certificate logs and DNS reveal infrastructure passively, and public repositories often expose secrets. The output is a prioritized surface map that drives later attacks.
- How it shows up
- Mapping is applied to seed exploitation, not recalled, and thorough mapping is what makes the timed range efficient.
- Common confusion
- Confusing passive with active techniques; querying the target's own DNS server for a zone transfer is active, while reading public certificate logs is passive.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Passive vs. active reconnaissance
Passive gathers data without contacting the target; active probes it.
- Remember
- Passive is stealthy; active is detectable.
- Tested as
- Stealth and surface mapping.
- Trap
- Calling direct scanning passive.
-
Certificate transparency logs
Public logs of issued TLS certificates.
- Remember
- They reveal subdomains passively.
- Tested as
- Subdomain discovery.
- Trap
- Assuming subdomains need active scanning.
-
DNS and reverse DNS enumeration
Querying DNS to map hosts and infrastructure.
- Remember
- Reverse lookups map IPs to names.
- Tested as
- Infrastructure mapping.
- Trap
- Confusing a normal lookup with a zone transfer.
-
WHOIS
Registration data for domains and IP ranges.
- Remember
- It reveals ownership and ranges.
- Tested as
- Footprinting.
- Trap
- Treating stale WHOIS data as current.
-
Repository and credential-dump OSINT
Public code and breach data often expose secrets.
- Remember
- Check repositories for committed keys.
- Tested as
- Information gathering.
- Trap
- Overlooking developer leaks.
-
Metadata analysis
Document and image metadata revealing users, software and paths.
- Remember
- It can expose internal detail.
- Tested as
- Footprinting.
- Trap
- Ignoring metadata in public files.
-
Attack surface mapping
Building a prioritized picture of exposed assets.
- Remember
- It drives where you attack.
- Tested as
- Planning.
- Trap
- Producing a flat list with no priority.
-
Shadow and forgotten assets
Internet-facing assets the target may not track.
- Remember
- They are common entry points.
- Tested as
- Surface discovery.
- Trap
- Mapping only known assets.
-
Technology fingerprinting
Identifying the software and versions a target runs.
- Remember
- It guides exploit selection later.
- Tested as
- Mapping.
- Trap
- Guessing technology without evidence.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Passive vs. active reconnaissance
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Passive recon | Gather data without contacting the target | Stealthy, low detection risk | Including direct scans |
| Active discovery | Probe the target directly | More detail, detectable | Using it when stealth is required |
OSINT source by goal
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Certificate logs / DNS | Subdomains and infrastructure | Passive mapping | Scanning when passive data suffices |
| Repositories / dumps | Leaked secrets and credentials | Fast path to access | Ignoring developer leaks |
| WHOIS / registries | Ownership and IP ranges | Scope and footprint | Trusting stale data |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Scan for stealth
- What candidates pick
- Run aggressive scans to map a target quietly.
- Why it looks right
- Scanning is thorough.
- Why it's wrong
- Active scanning is detectable; passive sources map stealthily.
Clue to watch for The scenario requires avoiding detection.
-
Zone transfer is passive
- What candidates pick
- Call a DNS zone transfer attempt passive recon.
- Why it looks right
- DNS feels like background lookups.
- Why it's wrong
- A zone transfer queries the target's DNS server, so it is active.
Clue to watch for The technique contacts the target's infrastructure.
-
Flat list
- What candidates pick
- Treat every discovered asset as equally important.
- Why it looks right
- A long list looks thorough.
- Why it's wrong
- Prioritizing the surface focuses limited exam time on the best targets.
Clue to watch for Time is limited and targets vary in value.
-
Ignore repositories
- What candidates pick
- Skip public code repositories during OSINT.
- Why it looks right
- They seem unrelated to the target network.
- Why it's wrong
- Repositories often leak credentials and keys that grant fast access.
Clue to watch for The target develops its own software.
-
Known assets only
- What candidates pick
- Map only the assets the target lists.
- Why it looks right
- They are easy to enumerate.
- Why it's wrong
- Shadow and forgotten assets are common entry points and must be discovered.
Clue to watch for The external footprint may exceed the known inventory.
Answer framework
For any CPENT Open Source Intelligence (OSINT) and Attack Surface Mapping scenario, use these steps.
- Decide whether stealth is required, and prefer passive OSINT when the target must not be contacted.
- Gather intelligence from the sources that fit the goal, such as certificate logs, DNS, WHOIS and repositories.
- Fingerprint technologies and discover shadow or forgotten assets to complete the surface, working methodically and documenting the outcome before moving on.
- Turn findings into a prioritized attack surface map that ranks targets by value and exposure.
- Carry the map into the active modules so exploitation is targeted rather than blind, and record evidence and the reasoning for each decision as you go, since the engagement is judged partly on the professional report you submit at the end.
Practice question
Want more like this? The CPENT practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Build a repeatable OSINT workflow and practice it against safe targets until mapping is fast and systematic. Learn which source answers which question: certificate logs and DNS for subdomains, WHOIS for ownership and ranges, repositories and dumps for secrets, and metadata for internal detail.
Keep passive and active techniques clearly separated, since stealth requirements decide which you use. Most importantly, practice turning findings into a prioritized surface map rather than a flat list, because on a timed range that prioritization is what directs your limited hours to the highest-value targets. Afterwards, move to Module 4, social engineering, another reconnaissance-adjacent discipline, before the technical attack modules. Throughout, keep a disciplined note-taking and evidence workflow, because the CPENT report and its evidence carry much of the score, and details are easily lost across a long, intense exam. Rehearse this in a lab until it is routine, and capture evidence as you work so the final report is complete and defensible.
FAQ
Is OSINT passive or active?
OSINT is largely passive, gathering public information without contacting the target. Active discovery, such as scanning, is a separate step.
Why does attack surface mapping matter so much?
On a long, progressive range, a good surface map directs limited exam time to the highest-value targets, while poor mapping leads to blind, wasteful attacks.
What is a DNS zone transfer?
A request for a full copy of a DNS zone from a misconfigured server. It contacts the target's DNS server, so it is an active technique.
Where do leaked secrets usually appear?
In public code repositories and breach dumps, where committed credentials, API keys and tokens can grant fast access.
What are shadow assets?
Internet-facing assets the target may not track or know about, which are common and often weakly defended entry points.
How does mapping connect to exploitation?
The services, technologies and trust paths found here determine where the network, web and other attack modules focus.
Does OSINT feed the report?
Yes. The surface map and intelligence gathered become part of the methodology and evidence recorded in the final report.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Practice Module 3 skills
You have covered OSINT sources, DNS and infrastructure discovery, and attack surface mapping. Practice turning intelligence into a prioritized map that targets your limited exam time.