A method used for gathering information about a target without interacting directly with it, i.e. using passive methods.
Typical sources are: social media, websites, news articles.
Resources
crt.sh: find active domains and subdomains from SSL certificates.Shodan: search internet for connected devices.- DNS records: find more connected hosts.
- DNS Dumpster: lookup website and find services and subdomain IPs.
- domain.glass: look up web and cloud infrastructure using
- greyhatwarfare: find possible cloud storage.
- Social media: lookup people connected to the target and see if they have posted useful information publicly.
- Target’s website: the target might display useful info on their own website, e.g. the services they provide or job advertisements that list their techstack.