Reconnaissance
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- [ ] Collect information about the target network, domains, and subdomains. - [ ] Identify domain controllers (DCs) and their roles. - [ ] Enumerate domains, trusts, and forests. - [ ] Gather information about users, groups, and computers. - [ ] Discover organizational units (OUs) and Group Policy Objects (GPOs). - [ ] Find service accounts and their permissions. - [ ] Enumerate DNS information for the target domains. - [ ] Identify DNS zones and records. - [ ] Check for DNS misconfigurations or vulnerabilities. - [ ] Gather information about DNSSEC and DNSSecuring. - [ ] Enumerate SMB shares and permissions. - [ ] Identify accessible shares, including hidden shares. - [ ] Check for misconfigured shares or exposed sensitive data.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of Reconnaissance during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to Reconnaissance.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Engagement checklist
Items we validate during scoping and execution for this topic.
What we assess
- Collect information about the target network, domains, and subdomains.
- Identify domain controllers (DCs) and their roles.
- Enumerate domains, trusts, and forests.
- Gather information about users, groups, and computers.
- Discover organizational units (OUs) and Group Policy Objects (GPOs).
- Find service accounts and their permissions.
- Enumerate DNS information for the target domains.
- Identify DNS zones and records.
- Check for DNS misconfigurations or vulnerabilities.
- Gather information about DNSSEC and DNSSecuring.
- Enumerate SMB shares and permissions.
- Identify accessible shares, including hidden shares.
- Check for misconfigured shares or exposed sensitive data.
Related topics
| Topic | Summary |
|---|---|
| Active Directory (AD) - Basics Understanding | Within Active Directory, there are three built-in groups that comprise the highest privilege groups in the director |
| Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| DLL | A DLL (Dynamic Link Library) is a file format used in Microsoft Windows environments to contain code, data, and resources that can be used by multiple programs simultaneously. DLLs help modularize applications, allowing them to share common functions without duplicating code acr… |
| Extended Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| I. Active Directory Enumeration | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| II. Local Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |