Passive Reconnaissance

Overview

Passive reconnaissance collects intelligence about a target from data that third parties already hold: registration records, certificate transparency logs, web archives, search indexes and DNS aggregators. Nothing in this skill connects to the target's own web servers. Your queries do go to third parties (crt.sh, the Internet Archive, HackerTarget, ipapi.co), and DNS lookups go through your resolver, which may reach the target's authoritative name servers, so the target's DNS logs can still show a lookup. Use it on domains you own or are authorized to assess, and treat everything found as a lead to confirm, not a fact.

Setup (a virtual environment keeps the packages out of your system Python):

$ python3 -m venv .venv && .venv/bin/pip install python-whois dnspython requests

Instructions

All snippets share these imports and a polite User-Agent. Set UA once and reuse it.