---
title: "Discovery"
canonical: https://trickest.com/glossary/recon
description: "Discovery collects information about a target's systems, people, and infrastructure to map the attack surface before any active testing begins."
---

# Discovery

Discovery is the information-gathering phase that opens almost every security assessment. Before touching a target, a team builds a picture of its domains, IP ranges, technologies, employees, and exposed services. The quality of this phase shapes everything that follows, since you cannot test what you never found.

Discovery splits into two modes. Passive discovery pulls from third-party sources, such as certificate logs, search engines, and public datasets, without sending traffic to the target. Active discovery queries the target directly through probes like port scans and DNS lookups, which is louder but more complete. Most of the data-gathering side draws on [OSINT](/glossary/osint), the practice of mining openly available information.

In practice discovery means enumerating the footprint: [subdomain enumeration](/glossary/subdomain-enumeration) to find hostnames, [DNS enumeration](/glossary/dns-enumeration) to map records and resolve them to IPs, and [asset discovery](/glossary/asset-discovery) to tie everything into a single inventory.

Discovery suits automation well because it is repetitive and benefits from breadth. A workflow can run dozens of discovery tools in parallel, merge and deduplicate their output, and re-run on a schedule so the inventory tracks a surface that never stops changing.

---
_Markdown source of https://trickest.com/glossary/recon._