Reconnaissance & Enumeration
Passive Recon & OSINT
Gathering intel without ever touching the target's systems.
Passive recon collects information from third-party sources, so the target never sees you looking. It's silent and often surprisingly productive.
- WHOIS & DNS — who owns the domain, mail servers, subdomains.
- Certificate transparency logs (crt.sh) — reveal subdomains via issued TLS certs.
- Google dorking — targeted search operators to find exposed files and pages.
- Public breaches & GitHub — leaked credentials and hardcoded secrets in code.
- LinkedIn — employee names for username formats and phishing context.
# Google dorks (search operators)
site:example.com filetype:pdf
site:example.com inurl:admin
intitle:"index of" site:example.com # exposed directory listings