> For the complete documentation index, see [llms.txt](https://evolvingsysadmin.gitbook.io/red-team-toolkit/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://evolvingsysadmin.gitbook.io/red-team-toolkit/reconnaissance.md).

# Reconnaissance

There are several effective methods for conducting recon for penetration testing:

* [DNS Recon](/red-team-toolkit/reconnaissance/dns-recon.md)
* [OSINT](/red-team-toolkit/reconnaissance/osint.md)
* [Web Application Recon](/red-team-toolkit/reconnaissance/web-application-recon.md)
* Vulnerability scanning

Reconnaissance, both passive and active, is a crucial phase in penetration testing as it helps the tester understand the target system's architecture, identify potential vulnerabilities, and design a more effective attack strategy.