TechKnowSurge
TechKnowSurge Catalog Videos Dumpster Diving
VideoSecurityFree

Dumpster Diving

Dumpster diving is a physical reconnaissance technique where attackers search discarded materials for sensitive information that can be used to target an organization. Unlike purely digital reconnaissance, this method carries legal risk and can expose data that employees fail to properly shred or destroy.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Reconnaissance against an organization does not always happen behind a keyboard. Physical reconnaissance techniques, such as dumpster diving, allow attackers to gather sensitive information simply by searching through discarded materials on or near a target's premises. The method is effective precisely because human behavior is inconsistent — even when organizations have shredding policies in place, employees do not always follow through, leaving documents, printouts, or other materials in general waste bins instead of secure disposal channels. For security professionals, dumpster diving represents a meaningful threat vector that is often underestimated. Improperly discarded materials can expose internal contact information, organizational structure, financial data, credentials, or system details that support further stages of an attack. Understanding how this technique works is essential for building effective data handling and disposal policies that reduce an organization's physical attack surface. From a legal standpoint, dumpster diving occupies a gray area that varies by jurisdiction, but it can carry serious legal consequences depending on the context and intent. Security practitioners and penetration testers must be aware of where passive information gathering ends and actionable intrusion begins. Recognizing this boundary is a core part of conducting ethical security assessments and advising organizations on comprehensive security awareness programs.

What you'll learn

What's covered

Dumpster Diving Reconnaissance

Key terms

Dumpster Diving
A physical reconnaissance technique where an attacker searches through an organization's discarded trash to find sensitive information that was not properly destroyed.
Reconnaissance
The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Social Engineering
A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Threat Actor
An individual or group responsible for a security incident or attack.

Topics

Dumpster Diving Physical Reconnaissance Social Engineering Information Disclosure Data Destruction Cybersecurity

Transcript

A lot of reconnaissance can be done digitally, that we could do it from the comfort of our own homes or anywhere in the world really, but it also can be done in person. We could do things like dumpster diving.

Most businesses have some sort of shredder. I even have a shredder of my own, my personal use, that when I put in a document it shreds it so it can't be read. However, when it comes to a company, usually within the company you have the shredder maybe in a certain location and everybody has to go to that location. Well, not everybody makes the effort to go and do that. So what ends up happening is some documents get thrown away rather than shredded. This can be a great source of information.

So how do we get at this information that's been thrown away? Well, we call this dumpster diving. Dumpster diving is when we start looking through the trash for information that's been thrown away that we can use to carry out our attacks. And I've heard of a lot of valuable information getting exposed through jumping into the dumpster and looking at all of the stuff that people have been throwing away.

Now, reconnaissance in itself could be considered an attack, but there's a lot that we can do within legal terms, that we can start researching a company before we ever consider it stepping over the line of legality. Now we start stepping into the realm of an attack that could have legal consequences if we're starting to do things like dumpster diving. So watch out with this. But this is one of the great ways that somebody could target a company and start researching information about the company.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →