<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-passive-infrastructure-mapping
description: >-
  Map target infrastructure passively using Shodan, Censys, BGP data, ASN
  lookups, and historical records to identify IP ranges, services, and
  cloud assets without touching the target.
domain: cybersecurity
subdomain: osint-recon
tags:
  - infrastructure
  - shodan
  - censys
  - asn
  - bgp
  - passive-recon
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  Shodan CLI/API, Censys API, BGPView, ipinfo.io,
  ARIN/RIPE WHOIS, cloud_enum, bbot.
metadata:
  mitre-attack:
    - "T1590"      # Gather Victim Network Information
    - "T1590.004"  # Gather Victim Network Information: Network Topology
    - "T1590.005"  # Gather Victim Network Information: IP Addresses
    - "T1596"      # Search Open Technical Databases
---

# Conducting Passive Infrastructure Mapping

## Overview

Passive infrastructure mapping reveals target network topology, IP ranges,
hosted services, cloud assets, and technology stacks without sending any
traffic to the target. Sources include Shodan, Censys, BGP route data,
Regional Internet Registries (RIRs), certificate transparency, and historical
DNS databases. Results produce an asset inventory that guides active phases.

## Prerequisites

- Shodan CLI and API key
- Censys API credentials
- Python 3.10+ with `requests`, `shodan`
- ipinfo.io API key (optional)
- cloud_enum for cloud asset discovery

```bash
pip install shodan censys requests
```

## Quick Reference

| Task | Command |
|------|---------|
| Shodan host | `shodan host 1.2.3.4` |
| Shodan search | `shodan search "org:\"Target Corp\""` |
| Shodan count | `shodan count "hostname:example.com"` |
| Censys search | `censys search "services.tls.certificates.leaf.names: example.com"` |
| ASN lookup | `curl -s "https://api.bgpview.io/asn/AS15169"` |
| IP prefixes | `curl -s "https://api.bgpview.io/asn/AS15169/prefixes"` |
| ipinfo | `curl -s "https://ipinfo.io/1.2.3.4?token=$IPINFO_TOKEN"` |
| Cloud enum | `cloud_enum -k example -l results.txt` |

## Workflow

### Step 1: Shodan Intelligence

```bash
# Host reconnaissance
shodan host 1.2.3.4

# Organization search — find all exposed assets
shodan search "org:\"Target Corporation\"" --fields ip_str,port,product

# Domain-based search
shodan search "hostname:example.com" --fields ip_str,port,product,os

# SSL certificate search
shodan search "ssl:\"example.com\"" --fields ip_str,port,product

# Specific service fingerprinting
shodan search "org:\"Target\" port:443 http.title:\"Admin\"" --fields ip_str,port
```

### Step 2: Censys Asset Discovery

```bash
# Search by certificate names
censys search "services.tls.certificates.leaf.names: example.com"

# Search by organization
censys search "autonomous_system.name: \"Target Corp\""

# View host details
censys view 1.2.3.4
```

### Step 3: ASN and BGP Mapping

```bash
# ASN lookup
curl -s "https://api.bgpview.io/asn/AS15169" | jq '.data | {name, description_short, country_code}'

# IP prefixes for ASN
curl -s "https://api.bgpview.io/asn/AS15169/prefixes" | jq '.data.ipv4_prefixes[].prefix'

# IP to ASN
curl -s "https://api.bgpview.io/ip/1.2.3.4" | jq '.data.prefixes[0] | {asn: .asn.asn, name: .asn.name, prefix: .prefix}'

# Reverse IP from domain
curl -s "https://api.bgpview.io/search?query_term=example.com"
```

### Step 4: Cloud Asset Enumeration

```bash
# cloud_enum — discover S3, Azure, GCP buckets
cloud_enum -k example -k example-prod -k example-dev -l cloud_results.txt

# Manual S3 enumeration patterns
for word in prod dev staging backup data assets; do
  curl -s -o /dev/null -w "%{http_code} example-${word}\n" "https://example-${word}.s3.amazonaws.com"
done
```

### Step 5: IP Intelligence Aggregation

```bash
# ipinfo.io for enrichment
curl -s "https://ipinfo.io/1.2.3.4?token=$IPINFO_TOKEN" | jq '{ip, org, asn, city, region, country}'

# VirusTotal IP report
curl -s -H "x-apikey: $VT_API_KEY" "https://www.virustotal.com/api/v3/ip_addresses/1.2.3.4" \
  | jq '.data.attributes | {as_owner, network, last_analysis_stats}'
```

## Detection Opportunities

- Shodan/Censys scans are pre-collected — queries do not touch the target
- Cloud enumeration with HTTP probes creates minimal server-side logs
- BGP/ASN queries are fully passive against public route data

## Verification

- [ ] Shodan queried for org and domain assets
- [ ] Censys searched by certificate and ASN
- [ ] ASN identified and IP prefix ranges mapped
- [ ] Cloud storage assets enumerated (S3/Azure/GCS)
- [ ] IP intelligence enriched with geolocation and reputation
- [ ] Asset inventory produced with confidence tags

## References

- [Shodan](https://www.shodan.io/)
- [Censys](https://search.censys.io/)
- [BGPView API](https://bgpview.docs.apiary.io/)
- [ipinfo.io](https://ipinfo.io/developers)
- [cloud_enum](https://github.com/initstring/cloud_enum)

---
v1.0 | Validated: 2026-03-17
