Passive Reconnaissance:

🌐 What is reconnaissance?

Before a cyberattack ever hits your inbox or reaches your firewall, there’s usually a quiet phase happening in the background — one where attackers aren’t launching exploits or scanning ports. They’re simply watching, researching, and collecting. This is called reconnaissance, and it’s the first and arguably most important phase of a cyber operation. In cybersecurity, reconnaissance is the process of gathering information about a target system, organization, or individual, often before launching an attack. It’s the groundwork — figuring out what’s out there, what’s exposed, and what can be exploited.

There are two main types of reconnaissance:

• Active Reconnaissance: This involves direct interaction with the target, such as port scanning or probing services. It’s noisy and detectable.

• Passive Reconnaissance: This involves collecting information without directly engaging the target, making it stealthy and much harder to detect.

Passive vs. Active Reconnaissance:

Passive reconnaissance is the process of gathering information about a target without directly interacting with its systems or network. That means no pings, no port scans, and no traffic touching the target. Instead, attackers (or ethical hackers) rely on publicly available data — sometimes called open-source intelligence (OSINT) — to build a profile of the target quietly and undetected.

👀 What Can Be Discovered Passively?

Even without touching the network, an attacker can uncover a surprising amount of intel:

• Domain ownership & history via WHOIS records

• Subdomains and infrastructure using DNS databases

• Technologies used via website fingerprinting

• Employee names & roles from LinkedIn or social posts

• Email addresses & naming conventions

• Exposed credentials from past data breaches

• Archived pages showing outdated systems or test environments

• Metadata in documents (like author names, usernames, software versions)

Why is This So Valuable?

Passive recon is like building a blueprint of the castle before ever attacking it. With this information, attackers can:

• Craft targeted spear phishing emails

• Identify third-party vendors as weak points

• Map out potential entry points without raising alarms

• Identify outdated or shadow IT systems exposed to the internet

And here’s the kicker: Defenders often don’t know what’s “passively” out there about them. That’s why this phase is just as important for cybersecurity teams to understand and monitor.

📡 Common Techniques and Sources Used in Passive Reconnaissance.

1. WHOIS.

   It’s a protocol that works on TCP port 43 and allows your computer to ask for information about domains, IP addresses, or networks — and then receive that info from a WHOIS server.

   When you run a WHOIS lookup on a domain (e.g., example.com), you can see:

   | Info Type | Example | | --- | --- | | Domain owner | Who registered the domain (person/company) | | Contact details | Email, phone (sometimes hidden with privacy) | | Registrar | Company that sold the domain (e.g., GoDaddy, Namecheap) | | Registration date | When it was first registered | | Expiration date | When the domain will expire | | Name servers | Servers that direct traffic to the correct website |

   We can use WHOIS utilising CLI:

    $whois google.com
   

   Or we can use online services like: WHOIS domaintools, whois.com

2. NSLOOKUP

   nslookup stands for Name Server Lookup. It’s a command-line tool used to query DNS servers to find out the IP address associated with a domain name — or vice versa. Think of it like asking the internet, “Hey, where can I find this website?” or “Who owns this IP address?”

   nslookup can be used in 2 ways:

   • Non-interactive Mode executes a single query and returns the result:

       $nslookup [options] [domain-name] [dns-server]
       $nslookup -type=AAAA mydomain.com 1.1.1.1
     

   • Interactive Mode allows multiple queries in a single session.

     Just type nslookup to start interactive mode:

       nslookup
       > set option
       > query
     

To see all functionality of nslookup, check Microsoft Docs NSLOOKUP

3. DIG

   It’s a CLI tool that is a more advanced tool than nslookup, used to query DNS (Domain Name System) servers. “dig” stands for Domain Information Groper.

   Basic syntax:

    $dig [options] [domain] [record type]
    $dig google.com MX
   

4. DNSDumpster

   Official website: https://dnsdumpster.com

   It’s a free online tool for DNS enumeration that helps you uncover a company’s digital footprint just by using its domain name.

   When investigating a domain, it’s crucial to explore potential subdomains, as they can often reveal valuable insights about the organization’s infrastructure. For example, imagine a domain like exampledomain.com has subdomains such as wiki.exampledomain.com and webmail.exampledomain.com. These could contain sensitive documentation or login portals that provide clues about the internal setup. It’s possible that some of these subdomains were launched and then neglected, which can lead to outdated services—prime targets for vulnerabilities.

   But how do you even find these subdomains in the first place?

   One effective strategy is to leverage a variety of search engines to compile a list of publicly visible subdomains. Relying on just one search engine likely won’t cut it. Be prepared to sift through multiple pages of results—some of the most revealing findings may be buried deep, since these subdomains are often not meant to be prominently indexed or advertised.

   DNSDumpster helps you uncover:

   • Subdomains

   • IP addresses

   • DNS records (A, MX, TXT, etc.)

   • Hosting providers

   • Network infrastructure (like cloud services being used)

   • Sometimes even historical records

5. Shodan.io

   Shodan (short for “Sentient Hyper-Optimized Data Access Network”) is a search engine for internet-connected devices—also called the “Google for hackers”.

   Created by John Matherly, it indexes information about:

   • Servers

   • Routers

   • IoT devices (like webcams, printers, smart fridges)

   • Industrial Control Systems (ICS/SCADA)

   • Databases (MongoDB, Elasticsearch, etc.)

   • Even things like Tesla Powerwalls or traffic lights (yes, really!)

Every time a device connects to the internet, it has a public IP address and may expose one or more open ports (like HTTP on port 80, SSH on 22, etc.). Shodan constantly scans the internet, probing billions of IPs, and when it finds an open port, it records:

• The banner (a small bit of data that describes the service, e.g., a web server’s version)

• Metadata (like device type, location, ISP, OS)

• The headers or messages returned (which can include version numbers, warning messages, and even default passwords)

Here is a link for Search Query Examples: https://www.shodan.io/search/examples