Passive vs active
Passive recon reads public data (WHOIS, DNS, certificate transparency logs) and is invisible to the target. Active recon sends packets — port scans, directory fuzzing — which are logged and can trip IDS. Raccoon combines both, so scope authorization matters.
Certificate transparency
Every TLS cert issued is published in public CT logs. Querying them (crt.sh style) reveals subdomains a company forgot existed — staging, dev, admin panels — without ever probing their servers. It's the single richest passive source.
Why enumerate ports
Each open port is a service, each service a version, each version a potential CVE. Mapping
80/443/22/3389 and beyond tells you the shape of the surface. Fewer exposed ports = smaller surface = fewer ways in.
⚠ Scanning hosts you do not own may be illegal.
Recon is the 80%
Practitioners say a thorough assessment is 80% recon, 20% exploitation. You cannot secure — or test — what you have not mapped. The exposure phase correlates all findings into a single attack graph: which asset, which port, which weakness.