New to PT and would like to test recon skills.

First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? I'd like to practice but am having trouble determining this.


Generally speaking anything which sends traffic directly to a company's site is considered active rather than passive.

Now most organisations will realise that traffic to a public facing site is fine and not an attack (as long as it's not excessive enough to cause a Denial of Service) but it is a legal grey area as, for example, a spider could hit content that the company considers non-public and that could cause a response from them.

I'd recommend that while you're practicing you stick to one of the many test applications that can be downloaded for example the OWASP Broken Web Applications Project

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.