In the first step before the penetration testing starts, you will need to passively collect the information about the company in scope. To accomplish this task, you will use the web, along with some automated tools that call the web at the backend as well. This phase is also called the collection of Open Source Intelligence (OSINT). OSINT refers to the information collected from the internet. Another name for this phase used by security professionals is reconnaissance. To be honest, they all refer to the same task, but you need to be aware of the different names used to describe this stage.
If your target (whether it's your client's target or that of the organisation for which you work) is an external web application, then you can execute the information-gathering phase, but if your target is an intranet...
