iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Passive Recon

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Passive recon = gather information without sending packets to the target. Only public sources, no scanning, no probing. The first phase of every engagement; legal everywhere, even outside the scope window.

Passive recon tools and sources

EXAMPLE
# 1) DNS
whois example.com
dig +short example.com NS MX TXT
dig +trace example.com
dig CHAOS TXT version.bind @ns1.example.com

# 2) Certificate transparency — every TLS cert is logged
curl -s 'https://crt.sh/?q=%25.example.com&output=json' \
    | jq -r '.[].name_value' | sort -u

# 3) Search engine reconnaissance (Google dorks)
site:example.com inurl:admin
site:example.com filetype:env OR filetype:bak
site:example.com intitle:"index of"

# 4) GitHub / GitLab
#    Search org name + 'password', 'api_key', 'AWS', 'BEGIN PRIVATE KEY'
#    https://github.com/search?q=org%3AExample+password&type=code

# 5) Wayback Machine — archived pages reveal removed endpoints
https://web.archive.org/web/*/example.com
#    waybackurls (Go tool) — bulk URL extractor
waybackurls example.com | tee wayback.txt

# 6) Shodan / Censys — internet-wide scans, indexed
#    No probing needed — they already scanned
shodan search 'org:"Example" port:443' --fields ip_str,port,product

# 7) LinkedIn + employee enumeration
#    Build the tech stack from job postings
#    Enumerate emails: theHarvester -d example.com -b google,bing,linkedin

# 8) Breach databases
#    HaveIBeenPwned API — known-compromised email + password reuse
#    DeHashed / IntelX — wider breach searching

# 9) Wappalyzer / BuiltWith — fingerprint web tech
wappalyzer https://example.com

# 10) Aggregators
#     SpiderFoot — automated OSINT pipeline that calls 100+ sources

Why it matters

Passive recon is the highest-signal lowest-noise phase. By the time you start active scanning, you should already know the cloud, the stack, the team size, and the recent CVEs — all from public data.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Passive recon = nothing touches the target's infrastructure.
# WHOIS, certificate transparency logs (crt.sh), DNS history,
# Google dorks (site:, inurl:), GitHub code search, archived pages.
Try it Yourself »

Discussion

Loading…