Passive and Active Reconnaissance

Passive Reconnaissance

Collecting information without directly interacting with the target's systems.

Passive Reconnaissance Examples

Company websites, social media, employee directories, and job postings.

OSINT

Open Source Intelligence; public-source research.

Active Reconnaissance

Directly interacting with the target network or device to gather technical information.

Active Reconnaissance Example

Scanning systems for operating systems and open ports.

Initial Access

Getting into the system using methods like phishing or stolen passwords.

Persistence

Long-term access that lets an attacker return without breaking in again. It may survive reboots or password changes.

Lateral Movement

Moving from the first compromised computer to other systems.

Taking Action

Stealing data, encrypting files for ransom, or destroying information.

Evading Detection

Hiding evidence by deleting logs, disabling security tools, or disguising activity.

Port 80

HTTP (regular web traffic).

Port 443

HTTPS (secure web traffic).

Attack Surface

The collection of possible entry points an attacker can try.

Nmap

Used by security professionals to discover devices and scan networks.

Social Engineering

Manipulating a person into revealing credentials or taking unsafe actions.

Command and Control (C2)

A setup letting an attacker remotely communicate with a compromised device.

RAT (Remote Access Trojan)

Malware that gives an attacker remote control of a compromised device.

Rootkit

Malware hiding deep inside the operating system to avoid detection.

Privilege Escalation

Gaining access to accounts with elevated permissions, such as system administrators.

Ports

Numbered channels for network traffic.

Terminal

A text-based command interface.

Password Attacks

Exploiting weak, predictable, or organization-related passwords.

Scheduled Tasks

Automated malware execution at specified times or startup.

Startup Programs

Launching malware upon user login.

Privilege Escalation

Gaining elevated permissions (e.g., admin or database manager). Enables attackers to access sensitive databases, disable antivirus tools, create admin accounts, and control larger network segments.

Lateral Movement

Traversing from the initial machine to other network assets using stolen credentials or shared connections.