<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Passive Reconnaissance

Gather intelligence without direct contact with the target infrastructure.

## Certificate Transparency

```bash
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u
```

CT logs expose subdomains that never appeared in DNS brute-force wordlists, including internal/staging environments with wildcard certs.

## DNS Passive History

SecurityTrails, DNSDB, Farsight DNSDB — look for historical A records pointing to old IPs, CNAMEs to third-party services that may have been abandoned (subdomain takeover indicators).

## WHOIS and Registration History

```bash
whois target.com
```

Note registrar, creation date, nameservers, registrant contact (often redacted but useful for cross-referencing).

## Google Dorking Patterns

```
site:target.com                          # enumerate indexed pages/subdomains
site:target.com filetype:pdf             # indexed documents
site:target.com inurl:admin              # admin panels
intitle:"index of" site:target.com       # open directories
"target.com" ext:sql | ext:bak | ext:env # leaked backup/config files
```

## GitHub Dorking

Search `org:targetcompany`, `"target.com" password`, `"target.com" api_key`, `"target.com" secret` — look for leaked credentials in public repos and commit history.

## Email Harvesting

```bash
theHarvester -d target.com -b google,bing,linkedin -l 500
```

Extracts emails, names, subdomains from public sources.

## Shodan / Censys

```bash
shodan search hostname:target.com
```

Discovers internet-facing assets before active scanning. Filter by `org:`, `asn:`, `ssl.cert.subject.cn:target.com`.

## Wayback Machine

Check archived pages for old endpoints, hidden paths, and tech stack clues.

```bash
gau target.com | grep -v "\.js\|\.css\|\.png"
```

Fetches all known URLs from web archives.

## Breach Data

```bash
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/user@target.com"
```

Identifies compromised credentials for social engineering context.

## Anti-Pattern

Skipping certificate transparency — CT logs expose subdomains that never appeared in DNS brute-force wordlists, including internal/staging environments with wildcard certs.

---
v1.1 | Validated: 2026-03-13
