Passive Recon

Whois

  • Basic Lookup
whois <Domain>

nslookup

  • Performing a basic DNS lookup
nslookup <Domain>
  • Usage with options 
nslookup -type=[options] <Domain>
  • Performing reverse DNS lookup 
nslookup <IP Address>
  • Querying A Records 
nslookup -type=a <Domain>
  • Querying SOA Record 
nslookup -type=soa <Domain>
  • Querying Ns Records
nslookup -type=ns <Domain>
  • Querying Mx Records
nslookup -type=mx <Domain>
  • Querying TXT Records
nslookup -type=txt <Domain>
  • Querying All Records
nslookup -type=any <Domain>

Shodan.io

  • Filter by IP ranges
net:<ip range>
  • Filter by Port 
port:<port>
  • Filter by Location
city:"<city>" country:<country_code> geo:<coords>
  • Filter by Hostname 
hostname:<hostname>
  • Filter by Operating System 
os:<operating system>
  • Filter by Vulnerability ID 
vuln:<CVE-ID>
  • Filter by Device 
device:"<device type>"
  • Filter by Product 
product:"<product name>"
  • Filter by Version
version:"<version>"

dig

  • Lookup A record (default):
dig <domain>
  • Lookup specific record types 
dig <domain> [options]

Options are the query types :

  1. AAAA
  2. MX
  3. NS
  4. TXT
  5. SOA
  6. SRV
  7. CNAME
  8. ANY
  • Query a specific DNS Server 
dig @[Server IP] [domain] [query]

Example : dig @8.8.8.8 example.com A , dig @8.8.8.8 example.com mx

  • Useful flags/Output controls
- +short //print only concise answers (IPs, records).

- +noall +answer //suppress everything except answer section.

- +nocmd //hide the command and header.

- +ttlunits // show TTL with time units.

- +multiline //long records nicely.

- +noquestion / +noauthority / +noadditional //hide sections.

- +comments / +cmd //show query comments and command line used.

Example: dig +noall +answer example.com MX
  • Zone Transfer 
dig AXFR @[Nameserver] [Domain]

Example : dig @ns1.example.com example.com AXFR

Google Dorking

  • Core Operators 
site:example.com //restrict to a domain or TLD.

filetype:pdf / filetype:env / filetype:sql //search by file extension.

inurl:login / inurl:admin //words in the URL path.

intitle:"index of" / intitle:"login" //words in the page title.

intext:"password" / allintext:api_key secret //words in page body.

allintitle: / allinurl: / allintext: //all terms must appear in that field.

cache:url //view Google’s cached copy.

related:example.com //sites similar to the given domain.

"exact phrase"  //exact phrase match.

before:YYYY-MM-DD / after:YYYY-MM-DD //filter by indexed date.
  • Subdomain & Cert Checks 
site:[domain] -www

site:[domain] intext:"@domain"
  • Exposed Credentials
site:example.com intext:"password" OR intext:"passwd"

filetype:env "DB_PASSWORD"

filetype:properties "secret" OR "api_key"

intext:"aws_secret_access_key" filetype:txt

theHarvester

  • Command Syntax
theHarvester -d <domain> -b <source> [options]
  • Options
-h //help 

-d <domain> //target domain.

-b <source> //data source

-l <limit> //number of results per source (limit).

-f <filename> //save results to file

-v / --verbose //verbose output
  • Common sources (pick with -b)
google, bing, duckduckgo, brave — search engines

crtsh, certspotter, bufferoverun — certificate transparency sources

dnsdumpster, rapiddns, securityTrails, netlas, projecdiscovery — DNS/asset sources

github-code, builtwith — code/site fingerprinting

shodan, censys, virustotal — hosts / certs / asset databases

haveibeenpwned, dehashed, leaklookup — breaches & leaks indexing