I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.

In the CEH book, it states that:

  • We can scan for a target using network tools (e.g. tarcert, nslookup and etc)..
  • Scanning happens in the footprinting process.

But I did a test in gocertify that states that scanning is pre-attack and not reconnaissance.

The question is: Which one is correct? I tried googling, but I'm still confused.

  • @clarity123 It is a global site, it is quite possible that someone says "good night" on another part of Earth, while you are in evening :-)
    – peterh
    May 31, 2019 at 6:56
  • 1
    BTW it seems to me people doing CEH certifications mostly learn from errors in explanations, unclear definitions and idiosyncrasies in the tests.
    – eckes
    May 31, 2019 at 9:11
  • Hello Luis and welcome to StackExchange. This is a fantastic first question to ask here. My recommendation is to change the title to be an actual question. This makes it easier to tell what you want to know, instead of what your question is about. Please see How to Ask for more information! And good luck for your CEH!
    – user163495
    May 31, 2019 at 13:21
  • Thank you all for the help cheers from
    – Sherlocker
    Jun 4, 2019 at 16:06

1 Answer 1


In an attempt to clear up your confusion, if you think of reconnaissance (or footprinting as you have here) as non-invasive - that is using tools that will contribute to your stock of information about your target without directly communicating with it (and potentially tipping your hand of your interest in the target). Tools that may fall into this category are Google, Bing, Shodan, dig, nslookup, theHarvester, etc.

Scanning is generally an activity that will interact directly with your target - and whilst maybe not informing the target immediately of your interest (if they're not looking), will potentially log your activity on their perimeter or web logs etc., depending on how the logging is configured. Tools that may fall into this category - with varying degrees of noisiness - are nmap, Nessus, Burp Suite, etc.

Scanning is a process that could be argued to bridge the pre-attack reconnaissance phase (i.e. non-interactive) and the more active attack phase (interactive), as it could fall into both. Example - you simply scan a target to find out what ports are listening (which would contribute to your information about the target but interacts, yet still may not trigger any logging alerts) but later on in the test you may scan/probe some of the ports more aggressively which may tell you what version of SQL is listening which may trigger an alert on the target.

To summarise, personally I prefer to define non-interactive and interactive information gathering as logically separate in an engagement, which will hopefully make things clearer for you.

As @eckes mentioned below, the more generally accepted terms for non-interactive and interactive are passive and active respectively.

  • Active/passive is more commonly used I guess. (And a potential target would be more alerted if they Don’t see scanning and backscatter activity then with typical internet noise)
    – eckes
    May 31, 2019 at 8:39
  • Technically correct (the best kind of correct! :) ) but I was aiming to use terms with less room for misinterpretation. I will add for completeness though.
    – user53693
    May 31, 2019 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .