In passive Recon, Pentest team attempt to gather information from sources of Open Source Intelligence like paste sites, leaked password repositories etc. — to gather information about the employees and the organization. In active Recon, pentester characterize the target systems and network — to identify potentially exploitable vulnerabilities or misconfigurations