Recon

Subdomain enumeration and attack surface mapping aggregate OSINT sources like WHOIS, DNS, and certificate transparency with optional authorized active scans. This structured discovery outputs domain maps, live IPs, and services for pentest planning.

Passive domain reconnaissance collects OSINT data without direct probing to build an asset map. You need it to safely inventory an organization's internet-facing surface using WHOIS, DNS, and certificate transparency before launching active checks.

Yes, active surface assessment supports authorized scanning across CIDR ranges and ASNs. It discovers live hosts, open ports, and service fingerprints to provide risk indicators suitable for structured threat mapping and security assessments.

Yes, explicit authorization is enforced before any active probing occurs. The workflow separates passive OSINT data collection from authorized active checks to ensure safe, scoped testing across targeted domains and netblocks.

The best way to inventory targets for pentest planning combines passive OSINT aggregation with controlled active checks. This surfaces subdomains, IPs, and asset mappings, enabling teams to scope safer, structured testing workflows.

Relying solely on passive OSINT data for infrastructure discovery limits visibility into live hosts and open ports. To overcome this limitation and generate comprehensive risk indicators, authorized active probing must be explicitly enabled.