Penetration › Module 3 › Lesson 1
Passive vs Active
Passive recon gathers without touching targets; active recon sends packets — both stay on $LAB_HOST scope only.
Visual · pentest_passive_vs_active
Passive/active recon literacy. $LAB_HOST only. Original Cyberlium.
Opening
Passive does not mean passive authorization. RoE still governs every technique.
Passive reconnaissance uses third-party data, DNS history, public records, and cached content — ideally without direct packets to the target. Active recon sends probes: ping sweeps, port scans, banner grabs — and belongs only on in-scope $LAB_HOST. Mixing the two without scope notes creates audit gaps and neighbor harm when students scan dorm LANs. Cyberlium teaches the distinction on YOUR lab. You will NOT Shodan-browse stranger infrastructure as 'passive homework' or nmap café Wi-Fi as 'active practice.' Next: OSINT Self/Lab Domain Only.
1. Passive: gather without direct probing
Examples: reading your own lab domain WHOIS, archived pages of a site YOU operate, job posts for YOUR test org, certificate transparency for domains you control. Passive reduces target load but still requires authorization when data describes scoped assets.
OSINT on strangers — doxing classmates, scraping neighbor social profiles — is out of scope and harmful. Not recon literacy.
Command guide
Try these commands — Passive: gather without direct probing
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
Host discovery — https://nmap.org/book/man-host-discovery.html Ping sweep literacy — $LAB_HOST only
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -sn "$LAB_HOST" nmap -sn "$LAB_HOST" -oG - | grep Up || true
Primary tools to practice this lesson: nmap. Reference sites: Host discovery (https://nmap.org/book/man-host-discovery.html); Ping sweep literacy. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Active: packets to in-scope hosts
Host discovery, port scans, and service probes are active recon. They belong on $LAB_HOST only after RoE and scope are written. Log commands, timestamps, and purpose in $HOME/cyberlium-lab notes.
Active recon on dorm /24, café gateways, or classmate IPs violates RoE — regardless of tool sophistication.
3. Label techniques in notes
Pentest reports distinguish passive intel from active findings. Your lab notes should tag each step: passive vs active, source, scope reference ($LAB_HOST).
Ship: two-row table — one passive example on YOUR lab domain, one active example on $LAB_HOST only. Next: OSINT Self/Lab Domain Only.
4. What you ship: passive vs active definitions for $LAB_HOST
Define both techniques. Active only on $LAB_HOST. Passive on self/lab domain only. NEVER stranger OSINT. chmod 600.
5. What you record before the next lesson
Date. Passive/active definitions. $LAB_HOST for active. File t19-m03-l01-passive-vs-active.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Call Shodan on stranger IPs 'passive.' nmap dorm /24 as 'active lab.'
Right
Write passive vs active with $LAB_HOST boundary. Next: OSINT Self/Lab Domain Only.
Mission: label recon techniques on YOUR scope
1) Define passive and active in one sentence each. 2) Give one example of each on YOUR lab scope. 3) List NEVER stranger OSINT. Never active-scan hosts not $LAB_HOST.
Stuck? Ask Cyberlium AI Mentor
Passive recon on strangers is still ethics territory — stay on self/lab domain.
Knowledge Check
APPLY: Active recon on Cyberlium belongs on:
Multiple choice
Knowledge Check
APPLY: True or False: Passive recon never requires authorization or scope.
True or False
Knowledge Check
APPLY: nmap on dorm subnet is:
Multiple choice