CompTIA PenTest+ (PT0-003): Reconnaissance and Enumeration

Click Here to Return To the CompTIA PenTest+ Course Page

Reconnaissance and Enumeration is 21% of the CompTIA PenTest+ (PT0-003) exam. This module covers how you map a target’s footprint, gather intelligence, and list every reachable service before you attack. Strong recon decides the whole engagement. The more you learn here, the fewer blind shots you take later.

Reconnaissance is the intelligence phase. You build a picture of the organization, its people, its domains, and its exposed systems. Enumeration is the detailed phase, where you list the specific services, accounts, shares, and versions on the hosts you found. Good recon feeds vulnerability discovery , so you spend time here to save time later.

Active vs. Passive Reconnaissance #

You gather information two ways, and the difference is whether you touch the target.

Passive recon avoids direct requests to the target systems, but third-party services might log a lookup or notify an account holder. Start with sources permitted by the engagement, then move to direct interaction only when scope and rules of engagement allow it.

OSINT (Open Source Intelligence) #

OSINT is information you collect from public sources. You harvest it from many places:

• Social media and job boards - employee names, roles, and the technologies a company hires for. A job ad asking for “Cisco ASA and Splunk experience” tells you the firewall and SIEM in use.
• Code repositories - GitHub and GitLab often leak hardcoded credentials, internal hostnames, and API keys in commit history.
• DNS lookups, Certificate Transparency logs, and cached pages - DNS records, publicly trusted certificates logged to CT, and old content. CT does not list every private or self-signed certificate.
• Password dumps - public breach data that shows reused or leaked employee credentials.

You use theHarvester to pull emails, subdomains, and hosts from public sources in one command:

theHarvester -d example.com -b bing,duckduckgo,crtsh

You query the Wayback Machine to find old pages, exposed directories, and removed admin panels that the live site no longer links. You feed names and domains into Maltego or SpiderFoot to map relationships between people, domains, and infrastructure automatically.

Network Reconnaissance #

Network recon discovers the systems and services exposed to the internet or the internal network.

• Protocol scanning - find which ports and services respond
• Certificate transparency logs - public logs of submitted publicly trusted certificates. They might reveal subdomains such as vpn.example.com, but omit private and self-signed certificates.
• Banner grabbing - read the version string a service returns when you connect
• HTML scraping - pull comments, paths, and metadata from web pages

You grab a service banner with Netcat to identify the software and version:

nc -nv 192.168.1.50 22
# SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5

That single line tells you the OS family, the SSH version, and a starting point for matching known vulnerabilities.

Enumeration Techniques #

Enumeration lists the details on the hosts you found. You perform OS fingerprinting, service discovery, DNS enumeration, host discovery, and share enumeration.

Nmap is the core tool. A version-and-OS scan with default scripts gives you most of what you need:

nmap -sV -O -sC -p- 192.168.1.0/24 -oA scan_results

You enumerate DNS to find subdomains and, when a server is misconfigured, pull the entire zone with a transfer:

dig axfr @ns1.example.com example.com

You enumerate SMB shares to find open file shares and exposed data:

smbclient -L //192.168.1.50 -N

Secrets Enumeration #

Modern targets expose credentials as well as services. Secrets enumeration looks for cloud access keys, passwords, API keys, and session tokens in code, configuration, and repositories. An exposed cloud key presents risk according to its permissions, resource policies, and surrounding controls. Record the finding without using the key unless the rules of engagement explicitly allow validation. Search authorized history as well as current files.

Scripting for Recon #

You modify and write small scripts to automate repetitive recon. The exam expects you to read and adjust Bash, Python, and PowerShell logic constructs like loops and conditionals. A simple Bash loop sweeps a subnet for live hosts:

for ip in 192.168.1.{1..254}; do
  ping -c1 -W1 "$ip" &>/dev/null && echo "$ip is up"
done

Knowing how to read and tweak a loop, an if statement, and a variable lets you adapt public scripts to your target instead of running them blind.

The Recon and Enumeration Toolkit #

Next Steps #

You now have a map of live hosts, open services, versions, and leaked secrets. Move to Vulnerability Discovery and Analysis to turn that map into a list of weaknesses, then Attacks and Exploits to exploit them. Review Engagement Management to confirm your active scans stay inside scope, and return to the CompTIA PenTest+ Course for the full path.