RT-RCON – Reconnaissance Fundamentals

Categories: English, Reconnaissance

About Course

Learn how professional red teamers uncover security weaknesses through structured reconnaissance that blends OSINT, environmental observation, camera-based documentation, surveillance analysis, photography and video, drone work, and passive WiFi and RFID discovery. This course shows how to build accurate target profiles, map digital and physical attack surfaces, document camera coverage and guard patterns, analyze vehicles and vendor activity, and prepare clear intelligence packages that drive mission planning and operational success.

Map digital and physical attack surfaces through structured reconnaissance.
Gather and analyze OSINT to build detailed target profiles.
Identify surveillance, camera coverage, and security patterns.
Perform passive WiFi and RFID reconnaissance to understand credential and network exposure.
Plan mission routes, document findings, and hand off actionable intelligence for operations.

Course Content

1.0 Recon Strategy & Planning

1.1 Recon Objectives vs Engagement Objectives
1.2 Intelligence Requirements
1.3 Prioritization and Tempo
1.4 Legal and Risk Gating

2.0 Open-Source Intelligence (OSINT)

3.0 Digital Surface Discovery

4.0 Network Reconnaissance

5.0 Camera & Surveillance Analysis

6.0 Photography – Technical Skills

6.1 ISO Explained for Surveillance
6.2 Aperture and Depth of Field
6.3 Shutter Speed Selection
6.4 Understanding Focal Length
6.5 Telephoto Lens Techniques
6.6 Tripod vs Handheld Shooting
6.7 Image Stabilization
6.8 Night Photography Setup
6.9 Low-Light Techniques
6.10 Infrared Photography
6.11 Filters for Surveillance
6.12 Metadata and Geotagging

About Course

What Will You Learn?

Course Content

1.0 Recon Strategy & Planning

1.1 Recon Objectives vs Engagement Objectives

1.2 Intelligence Requirements

1.3 Prioritization and Tempo

1.4 Legal and Risk Gating

2.0 Open-Source Intelligence (OSINT)

2.1 OSINT Methodology Overview

2.2 Target Profiling Techniques

2.3 Social Media Intelligence

2.4 Public Records Research

2.5 Google Dorking Mastery

2.6 Domain Reconnaissance

2.7 Email Harvesting

2.8 OSINT Legal Boundaries

3.0 Digital Surface Discovery

3.1 Subdomain Enumeration

3.2 Certificate Transparency

3.3 Infrastructure Correlation

3.4 Passive DNS

3.5 Cloud Asset Discovery

4.0 Network Reconnaissance

4.1 Passive Banner Collection

4.2 AS Mapping and Attribution

4.3 Service-to-Facility Mapping

5.0 Camera & Surveillance Analysis

5.1 Camera Types and Identification

5.2 Camera Placement Analysis

5.3 PTZ Behavior Patterns

5.4 Blind Spot Mapping

5.5 Metadata Extraction

5.6 Long-Term Pattern Analysis

6.0 Photography – Technical Skills

6.1 ISO Explained for Surveillance

6.2 Aperture and Depth of Field

6.3 Shutter Speed Selection

6.4 Understanding Focal Length

6.5 Telephoto Lens Techniques

6.6 Tripod vs Handheld Shooting

6.7 Image Stabilization

6.8 Night Photography Setup

6.9 Low-Light Techniques

6.10 Infrared Photography

6.11 Filters for Surveillance

6.12 Metadata and Geotagging

7.0 Video Documentation

7.1 Video Recording for Operations

7.2 Frame Rate and Resolution

7.3 Audio Recording and Consent

7.4 Covert Recording Equipment

7.5 Video Timeline Creation

8.0 Drone Operations

8.1 Drone Selection for Red Team Work

8.2 Camera Settings for Aerial Recon

8.3 Flying at Night

8.4 Aerial Reconnaissance Best Practices

9.0 Vehicle-Based Recon

9.1 Drive-Route Profiling

9.2 Delivery Pattern Analysis

9.3 Parking and Loading Assessment

9.4 Vehicle Staging Methods

10.0 Human Intelligence

10.1 Guard Rotation Observation

10.2 Uniform and Badge Analysis

10.3 Vendor Pattern Recognition

10.4 Building Personnel Timelines

11.0 Supply Chain Recon

11.1 Vendor Access Mapping

11.2 Procurement Intelligence

11.3 Third-Party Integration Points

12.0 RFID Systems Reconnaissance

12.1 Badge System Types and Identification

12.2 RFID Frequency Identification

12.3 Credential Flow Mapping

13.0 WiFi Reconnaissance

13.1 SSID/BSSID Mapping to Zones

13.2 IoT and Device Identification

13.3 Long-Range WiFi Techniques