TABLE OF CONTENTS So, you want to hack something? First, you have to find it! Reconnaissance is quite possibly the least understood, or even the most misunderstood, component of Internet penetration testing. Indeed, so little is said on the subject that there isn't even a standard term for the exercise. Many texts refer to the concept as enumeration, but that is somewhat vague and too generally applied to do justice to the concept covered here. The following definition is from Encarta :
*re con nais sance n
The exploration or examination of an area, especially to gather information about the strength and positioning of enemy forces.
A preliminary inspection of a given area to obtain data concerning geographic, hydrographic, or similar information prior to a detailed or full survey.
The preceding definitions present the objectives of the reconnaissance phase concisely; namely, "to gather information about the strength and position of enemy forces" a "preliminary inspection to obtain data...prior to a detailed survey." As in conventional warfare, the importance of this phase in the penetration testing process should not be underestimated.
Analogies aside, there are a number of very strong technical reasons for conducting an accurate and comprehensive reconnaissance exercise before continuing with the rest of the penetration test:
Ultimately, computers and computer systems are designed, built, managed, and maintained by people. Different people have different personalities, and their computer systems (and hence the computer system vulnerabilities) will be a function of those personalities. In short, the better you understand the people
