Dec 31, 2025, 01:46 AM
Passive reconnaissance is an extremely important and overlooked hacking step. Lots of tools do this, but it's good to know how to do this manually. The less you need to interact with your target, the less they know. I know this is obvious, but I feel passive scanning is really overlooked. I'll break this up into four websites: https://dnsdumpster.com/, https://sitereport.netcraft.com/, sslchecker.com https://web.archive.org/.
Let's start off with https://dnsdumpster.com/. This site is great for initial DNS recon, and sometimes it also tells you what tech the site is running. This is a bread crumb because it's useful information we got while looking for DNS information.
Next, we'll talk about Netcraft's site report function. This gives us forward and reverse DNS information, SSL, and Site Technology data. Netcraft is a gold mine when it comes to site tech. You can also get IPs and scan the subnets for more subdomains.
sslchecker.com is a good one because SSL information is rich and often overlooked. You might see out-of-date certifications indication of poor sysadmin practices. One time, I saw Barracuda Networks in an SSL certificate, and I wouldn't have seen it unless I checked the SSL cert.
Lastly, I want to go over the importance of web.archive.org. Using this site, you can see historical snapshots of a website, which can be valuable if they are not consistent with obfuscating JavaScript. JavaScript is where the good stuff is; there are API keys and, importantly, API endpoints.
Ok, let's see what we can do prior to touching the target. First, we got the Tech stack, so we can make a list of misconfigurations and login points. This gives us two attack vectors: misconfigurations and default or weak creds. If archive.org works, it can give us the JavaScript, and we can get API tokens and endpoints. We can plan accurate attacks based on software misconfigurations or use strong passwords. We can also list found API endpoints and rate them on whether they return PII. Just these four sites give us a wealth of information, and soon enough, the bread crumbs will start adding up. The idea is to have well well-known site get this information instead of using Tor proxies and scripts.
Let's start off with https://dnsdumpster.com/. This site is great for initial DNS recon, and sometimes it also tells you what tech the site is running. This is a bread crumb because it's useful information we got while looking for DNS information.
Next, we'll talk about Netcraft's site report function. This gives us forward and reverse DNS information, SSL, and Site Technology data. Netcraft is a gold mine when it comes to site tech. You can also get IPs and scan the subnets for more subdomains.
sslchecker.com is a good one because SSL information is rich and often overlooked. You might see out-of-date certifications indication of poor sysadmin practices. One time, I saw Barracuda Networks in an SSL certificate, and I wouldn't have seen it unless I checked the SSL cert.
Lastly, I want to go over the importance of web.archive.org. Using this site, you can see historical snapshots of a website, which can be valuable if they are not consistent with obfuscating JavaScript. JavaScript is where the good stuff is; there are API keys and, importantly, API endpoints.
Ok, let's see what we can do prior to touching the target. First, we got the Tech stack, so we can make a list of misconfigurations and login points. This gives us two attack vectors: misconfigurations and default or weak creds. If archive.org works, it can give us the JavaScript, and we can get API tokens and endpoints. We can plan accurate attacks based on software misconfigurations or use strong passwords. We can also list found API endpoints and rate them on whether they return PII. Just these four sites give us a wealth of information, and soon enough, the bread crumbs will start adding up. The idea is to have well well-known site get this information instead of using Tor proxies and scripts.