Passive Recon and OSINT

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

Passive reconnaissance gathers intelligence about a target without sending traffic to its infrastructure — using public records, search engines, and third-party data. It is the quiet first step of any engagement.

#DNS & WHOIS

whois example.com                 # registrar, org, contacts
dig example.com ANY +noall +answer
dig +short txt example.com        # SPF/DMARC can leak infra

#Certificate transparency

Public CT logs reveal subdomains and internal hostnames:

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

#OSINT tooling

theHarvester -d example.com -b bing,crtsh,dnsdumpster   # emails, hosts, subdomains
amass intel -d example.com                              # passive asset intel

#Google dorking

site:example.com ext:pdf
site:example.com inurl:admin
intext:"index of" site:example.com

Tip: Build your asset list here, then move to active enumeration in Subdomain and Asset Discovery and Nmap Security Cheat Sheet.