Passive Reconnaissance

Reconnaissance is the phase where the adversary gathers information about the target. The gathered information is leveraged in later phases — to plan and execute initial access, to scope and prioritise post-compromise objectives, or to drive further reconnaissance. Based on interaction with the target there are two types: passive and active.

Objectives of information gatheringSearch on YouTubeBookmarkSaved

• Build a blueprint of the target's organisational structure, network information and host information.
• Understand the target's overall security posture and where flaws exist, so the tester can focus on the low-hanging fruit.

Types of information collected:

• Network / host information — IP addresses, DNS, servers.
• Employee information — name, identity, email, role.

Passive reconnaissance means gathering information without direct contact with the target's hosts. It uses third-party and public sources, so it is effectively undetectable by the target.

DNS lookup toolsSearch on YouTubeBookmarkSaved

host example.com              # simple DNS lookup
host -t ns example.com        # -t = record type; ns = Name Server records
nslookup example.com          # query internet name servers
dig example.com               # DNS lookup (domain information groper)
dnsrecon -d example.com       # gather DNS info about a domain

The -t flag of host specifies the record type; ns asks for Name Server records.

WHOIS and web fingerprintingSearch on YouTubeBookmarkSaved

whois microsoft.com           # domain registration info from public WHOIS databases
wafw00f <target-website>      # detect a Web Application Firewall protecting a site
whatweb iiitkottayam.ac.in    # fingerprint the technology stack behind a site

• WHOIS retrieves domain registration information (registrar, contacts, dates). Web version: who.is.
• wafw00f detects Web Application Firewalls protecting a target, so you know the defences before attacking.
• whatweb reveals the web technology stack. If it shows, for example, PHP 7.4.22, you can look up vulnerabilities tied to that version.

Other passive-recon sites: sitereport.netcraft.com and dnsdumpster.com.

OSINT harvesting toolsSearch on YouTubeBookmarkSaved

theHarvester -d microsoft.com -b all   # email / OSINT harvesting (-b = source)
sublist3r -d hackersploit.org          # subdomain enumeration
exiftool <file>                        # read metadata of images, audio, video, docs
man exiftool

• theHarvester gathers OSINT on a company — mainly email harvesting. -d is the domain, -b the data source (all uses every source).
• Sublist3r enumerates subdomains of a domain.
• exiftool reads, writes and edits metadata embedded in files, especially images (author, software, GPS, timestamps). Useful on files publicly linked to a domain.
• Sherlock hunts a username across social networks.

Google dorkingSearch on YouTubeBookmarkSaved

Google Dorking (Google Hacking) uncovers sensitive information exposed on the web using advanced search operators. These queries are passive — they search Google's index, not the target directly.

site:microsoft.com
site:microsoft.com -www.microsoft.com
site:*.iiitkottayam.ac.in
intitle:hacking tools
intitle:"hacking tools"
inurl:"login"
filetype:pdf penetration testing
inurl:microsoft.com filetype:pdf

The quotes matter: intitle:hacking tools finds "hacking" in the title and "tools" anywhere on the page, while intitle:"hacking tools" requires the exact phrase in the title.

OSINT tools and frameworksSearch on YouTubeBookmarkSaved

OSINT (Open-Source Intelligence) tools collect and analyse publicly available information for investigations, reconnaissance and threat intelligence, without hacking or unauthorized access.

• haveibeenpwned.com — check whether an email appears in known breaches.
• Shodan — a search engine for devices (webcams, routers, servers, industrial systems, IoT), not websites. Create queries to find exposed services.

port:21 country:US            # devices with FTP (port 21) open in the US

Example Shodan queries: all devices running Apache in India; devices with open FTP (port 21) in the US.

Automated OSINT frameworksSearch on YouTubeBookmarkSaved

# Maltego on Kali
sudo apt update
sudo apt install maltego
maltego

# SpiderFoot
spiderfoot -l 127.0.0.1:5001   # then open in the browser and create a new scan

Maltego's Data Hub connects to external providers: Utilities (basic transforms: Domain, IP, DNS, Website), VirusTotal (malware reports, malicious IPs, hashes), AlienVault OTX (threat indicators / IOCs), OpenCTI (threat actors, malware, campaigns, MITRE ATT&CK), Shodan (open ports, services, banners), HaveIBeenPwned (breached emails), News, and MaxMind (IP geolocation). Choose the Community edition.

Quick self-testSearch on YouTubeBookmarkSaved