# Reconnaissance Methodology

> Master the art of the footprint. Differentiate passive and active recon, leverage OSINT, enumerate subdomains, and weaponize search engines before you ever touch the target network.

Canonical: https://codelivly.com/rooms/reconnaissance-methodology
Last updated: 2026-07-07

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 200 |

Before you send a single packet to the target network, the battle is already being won or lost in the shadows of the open-source internet. Amateurs jump straight into Nmap, trigger the Intrusion Detection System, and get blocked. Professionals spend 80% of their engagement in the reconnaissance phase, building a massive, highly detailed dossier on the target using passive intelligence, OSINT frameworks, and advanced search operators.

In this module, we transition from network probing to deep intelligence gathering. You will learn the critical operational security (OPSEC) differences between passive and active reconnaissance, master the OSINT lifecycle, automate subdomain enumeration to find forgotten development environments, and weaponize Google Dorking to uncover exposed credentials, admin panels, and sensitive documents. Stop guessing. Start mapping the target's entire digital footprint from the outside in.

## Lessons

1. What is Reconnaissance? (30 min)
2. Passive vs Active Recon (30 min)
3. Subdomain Enumeration (30 min)
4. Google Dorking Fundamentals (30 min)
5. Guided Lab: Full OSINT Profile on Target (30 min)

## Related

- [Learning path: Recon & Enumeration Tools](https://codelivly.com/learning-paths/recon-enumeration-tools)
- [All rooms](https://codelivly.com/rooms)