Passive Recon and OSINT

What Passive Reconnaissance Is

Passive reconnaissance is the process of gathering information about a target without directly interacting with its infrastructure. You never send a packet to the target's servers. Instead, you collect data from third-party sources: public databases, search engines, social media, and leaked data repositories.

Why Passive Recon Comes First

Passive recon is always your starting point because:

1. It is undetectable — The target has no log of your activity because you never touched their systems
2. It is legal — You are only accessing publicly available information
3. It shapes active testing — The intelligence you gather tells you where to focus active scanning
4. It reveals attack surface — Subdomains, exposed credentials, and forgotten endpoints are often discovered passively

Categories of Passive Intelligence

Technical Intelligence:

• Subdomains and IP ranges
• SSL/TLS certificate details
• Technology stack identification
• DNS records and history

Human Intelligence:

• Employee names and email formats
• Job postings revealing technology stack
• Social media presence
• Leaked credentials in data breaches

Organizational Intelligence:

• Company structure and subsidiaries
• Acquisitions and partnerships
• Physical locations and office addresses

The OSINT Framework

The OSINT Framework (osintframework.com) is a curated collection of tools organized by intelligence category. Key categories include:

• Username — Search for usernames across platforms
• Email — Find email addresses and verify them
• Domain/DNS — Enumerate subdomains and DNS records
• Social Media — Gather information from LinkedIn, Twitter, etc.
• Leaked Data — Search breach databases for exposed credentials

Rules of Engagement Considerations

Even passive recon has boundaries:

• Data handling — If you discover leaked credentials, handle them according to your rules of engagement
• Scope — Only gather information about the agreed target; do not collect data on third parties
• Documentation — Record all sources and findings for your report

Certificate Transparency Logs

Certificate Transparency (CT) is a public log of all TLS certificates issued by certificate authorities. When a certificate is issued for *.example.com, it is recorded in CT logs — even if the subdomain is not publicly linked.

How to use CT logs:

# Using crt.sh to find subdomains
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq '.[].name_value' | sort -u

This returns all subdomains that have had certificates issued. Look for:

• Internal subdomains (dev, staging, test, api)
• Old subdomains no longer in use
• Subdomains pointing to third-party services

DNS History

Services like SecurityTrails, DNSDumpster, and ViewDNS.info maintain historical DNS records. These reveal:

• Old IP addresses — The target may have moved hosting, but old servers might still be running
• Historical subdomains — Subdomains that were once active but removed from current DNS
• MX records — Reveal email providers and potential phishing targets
• TXT records — Often contain verification tokens, SPF records, and other configuration data

Wayback Machine

The Internet Archive's Wayback Machine (web.archive.org) stores snapshots of websites over time. Use it to:

• Find retired endpoints that may still be accessible
• Discover old file paths and parameters
• Identify technology changes over time
• Find exposed backup files or configuration that was once public

# Query Wayback Machine for all captured URLs
curl -s "http://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=text&fl=original&collapse=urlkey" | sort -u

Search Engine Dorking

Google and other search engines index content that is not linked from the main site. Use search operators to find:

# Find exposed files
site:example.com filetype:pdf
site:example.com filetype:sql
site:example.com inurl:admin

# Find sensitive information
site:example.com intitle:"index of"
site:example.com ext:bak OR ext:old OR ext:backup

# Find login pages
site:example.com inurl:login OR inurl:signin

Leaked Credential Databases

Services like Have I Been Pwned (haveibeenpwned.com) and DeHashed aggregate data breaches. Search for:

• Employee email addresses in known breaches
• Passwords associated with the target domain
• Exposed API keys and tokens

If employee credentials are found in breaches, password reuse becomes a viable attack vector.

Automated OSINT Gathering

theHarvester — Collects emails, subdomains, IPs, and URLs from public sources:

theHarvester -d example.com -b google,bing,linkedin,dnsdumpster

Recon-ng — Modular OSINT framework with modules for specific data sources:

recon-ng
[recon-ng][default] > use recon/domains-hosts/bing_domain_web
[recon-ng][bing_domain_web] > set SOURCE example.com
[recon-ng][bing_domain_web] > run

Shodan — Search engine for internet-connected devices. Find:

• Exposed services and their versions
• Default credentials on IoT devices
• Misconfigured databases
• Open ports and banners

import shodan
api = shodan.Shodan('API_KEY')
results = api.search('org:"Example Corp"')
for result in results['matches']:
    print(result['ip_str'], result['port'], result['product'])

Social Media Intelligence

LinkedIn reveals:

• Employee names and job titles
• Technology stack (from job postings and skills)
• Organizational structure
• Recent hires (new employees are prime phishing targets)

Twitter/X reveals:

• Employee interests and projects
• Technology discussions
• Potential password hints (pet names, birthdays)

GitHub and Code Repositories

Search GitHub for:

• Accidentally committed credentials
• Internal project names and structures
• Configuration files with API keys
• Source code of proprietary applications

# Search GitHub for exposed credentials
# Use GitHub code search: https://github.com/search
# Search for: "example.com" AND "password"
# Search for: "example.com" AND "api_key"

Practical Example: Building a Target Profile

Target: example.com

1. CT logs → Found 47 subdomains including dev.example.com, staging.example.com, api-v1.example.com
2. DNS history → Found old IP range 192.168.1.0/24 no longer in current DNS
3. Wayback Machine → Found /admin/backup.zip captured in 2019
4. theHarvester → Found 23 employee emails, identified email format as firstname.lastname@example.com
5. Shodan → Found exposed Redis server on dev.example.com:6379
6. GitHub → Found committed AWS access key in a public repo

This profile gives you multiple attack vectors without sending a single packet to the target.