Domain 2 of CEH v11 Reconnaissance Techniques (21%)
                     Domain 2 of CEH v11: Reconnaissance 
Techniques (21%)
www.infosectrain.com | [email protected]
www.infosectrain.com | [email protected]
Domains of CEH
CEH v11 comprises the following domains:
1.Information Security and Ethical Hacking Overview-6%
2.Reconnaissance Techniques-21%
3.System hacking phases and Attack Techniques-17%
4.Network and perimeter hacking-14%
5.Web application hacking-16%
6.Wireless network hacking-6%
7.Mobile platform, IoT, and OT hacking-8%
8.Cloud Computing-6%
9.Cryptography-6%
www.infosectrain.com | [email protected]
www.infosectrain.com | [email protected]
We will discuss the second domain of CEH, which is ‘Reconnaissance 
Techniques’.
What is reconnaissance?
Reconnaissance is the initial step that every ethical hacker follows. 
Reconnaissance is a method of gathering all the important information about 
our target system and network.
The ethical hacker follows the below steps to gather the maximum information 
about the target:
1.Collect the initial information
2.Determine the range of the network
3.Identifies the active machines
4.Identifies the access ports and open ports
5.Fingerprint the operating system
6.Uncover services on ports
7.And finally, map them.
www.infosectrain.com | [email protected]
Types of reconnaissance
There are two types of reconnaissance:
1.Active reconnaissance: Active reconnaissance is a process of gathering 
information by directly engaging with the target system. Ethical hackers can 
perform active reconnaissance by using different tools like Netcat, Ping, and 
Traceroute. This recon is faster and accurate; simultaneously, the chances of 
getting detected are also very high because the ethical hacker is directly 
interacting with the target system.
2.Passive reconnaissance: Passive reconnaissance is the process of gathering 
information about a target computer or network without actively using it. It’s 
a way to acquire data about a victim without making them aware of it. 
Ethical hackers use tools like Shodan and Wireshark to perform passive 
reconnaissance.
www.infosectrain.com | [email protected]
Reconnaissance Techniques:
There are three reconnaissance techniques:
 Footprint and reconnaissance
 Scanning networks
 Enumeration
www.infosectrain.com | [email protected]
1.Footprint and reconnaissance: Footprinting is a technique used to gather 
as much information as possible about a target network, victim, or system. 
It aids hackers in several ways to compromise a company’s infrastructure. 
The security posture of the target may also be determined using this kind 
of penetration testing.
Footprinting can be done passively or actively. Passive footprinting, such as 
looking at a company’s website and collecting information, active 
footprinting, such as using social engineering techniques to access sensitive 
data.
During this phase, ethical hackers will collect information like:
 IP addresses
 Domain name
 Employee information
 Namespaces
 E-mails
 Phone numbers
www.infosectrain.com | [email protected]
2. Network scanning: Network scanning identifies active ports, hosts, and 
the various services used by the target application. For example, assume 
you are an ethical hacker and trying to find weak points in the application. 
You use network scanning to find out those points.
In simple terms, to hack a network, you’ll need to discover a weak point in 
the system that can be exploited. Such network nodes can be located by 
performing a Network Scanning operation.
The difference between reconnaissance and network scanning
Assume you are a police officer and are planning to find some criminal. 
First of all, you will gather all the information about the criminals like 
name, location, and daily routine, which is called reconnaissance. Then 
you will find an entry point to enter into his home to attack him, and the 
process of finding the entry point is called network scanning.
www.infosectrain.com | [email protected]
Types of network scanning
There are two types of network scanning:
Port scanning: Port Scanning, as its name suggests, finds out which ports are 
active on the network. Scanners transmit client requests to a range of ports on 
the target network and then store the details of the ports that respond to the 
requests. In this way, active ports are discovered.
There are various types of port scanning. They are:
 TCP scanning
 SYN scanning
 UDP scanning
 ACK scanning
 Window scanning
 FIN scanning
Vulnerability scanning: An ethical hacker uses vulnerability scanning to find out 
the weaknesses in the network. This identifies vulnerabilities that are caused by 
inappropriate programming or misconfigured networks.
www.infosectrain.com | [email protected]
3. Enumeration: Enumeration is described as the procedure by which the 
user names, hostnames, network resources, shares, and services may be 
extracted from a system. In this step, the attacker connects with the system 
and makes directed requests to learn more about the target.
By using enumeration, ethical hackers can get the information of:
 SNMP data, if they are not secured correctly.
 Network shares
 Usernames of different systems
 IP tables
 Password policies lists
www.infosectrain.com | [email protected]
CEH with InfosecTrain:
InfosecTrain is one of the leading training providers with a pocket-friendly 
budget. We invite you to join us for an unforgettable journey with industry 
experts to gain a better understanding of the Certified Ethical Hacker course.
 Courses can be taken as live instructor-led sessions or as self-paced courses, 
allowing you to complete your training journey at your convenience.
www.infosectrain.com | [email protected]
About InfosecTrain
• Established in 2016, we are one of the finest 
Security and Technology Training and 
Consulting company
• Wide range of professional training programs, 
certifications & consulting services in the IT 
and Cyber Security domain
• High-quality technical services, certifications 
or customized training programs curated with 
professionals of over 15 years of combined 
experience in the domain
www.infosectrain.com | [email protected]
Our Endorsements
www.infosectrain.com | [email protected]
Why InfosecTrain Global Learning Partners
Certified and Flexible modes Access to the 
Experienced Instructors of Training recorded 
sessions
Post training Tailor Made 
completion Training
www.infosectrain.com | [email protected]
Our Trusted Clients
www.infosectrain.com | [email protected]

Contact us
Get your workforce reskilled 
by our certified and 
experienced instructors!
IND: 1800-843-7890 (Toll Free) / US: +1 657-221-
1127  / UK : +44 7451 208413
[email protected]
www.infosectrain.com