If the hacker decides to attack the system, the first step is reconnaissance.

But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or modify the existing software/tools for them to be "tap-able".

For example, suppose the hacker tries to attack the telephone network, and for some reason the dial-up modems are not available, the hacker may need to reverse engineer the telephone cable I/O, figure out a way to connect to the telephone network using the makeshift hardware and software (maybe connect to the sound card, and make use of the Fourier transform algorithms; and then figure out the commands sent across the telephone network) -- all to just be able to perform reconnaissance.

Is there a specific term for this step?

2 Answers 2


I would suggest that if this is targetted, this is part of reconnaissance. Specifically you talk about attacking the telephone network so reverse engineering the correct protocols, etc, which involves getting info on what the correct protocols and details for that network are. This is an early part of reconnaissance - possibly strategic rather than tactical reconnaissance.

If you're just talking about downloading some generic tool then well, that's just gearing up I guess?

  • One way to think about this: Suppose the "generic tool" is not available, or IS available but isn't tappable. In which case the hacker will need to develop the tool of his own, or find a way to feed the generic tool the specific data, or find a way to receive the data from that generic tool. Anyway, if this is a sub-step of reconnaissance, then isn't there a term for this I guess?
    – tabdiukov
    May 14, 2021 at 6:30
  • @tabdiukov : your question was perfectly clear. This is fully within the reconnaissance step. Depending on the level of attack, this step may have to start at a very low level of noise ( intelligence gathering outside of the final target ) rising progressively up to be able to enter the next level.
    – dan
    Feb 8 at 10:32

Kill chains are not linear. They are loops of loops. So;

  • there was an "info gathering/reconnaissance" phase that identified that the modem was not on and that a custom cable was required
  • a "weaponisation/exploitation" phase to create the required tools
  • then a new "info gathering/reconnaissance" phase to see where to go next
  • and so on ...

So, there is no need for a special term. It's just a matter of context and where one is in the process.

I encourage you to look up the OODA Loop to get a better idea of the "loops of loops" concept.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.