Reconnaissance is how an attacker decides where to spend effort. Passive collection uses public sources without sending traffic to the target, which makes it low-risk and surprisingly revealing.
What public sources reveal
- DNS: subdomains, mail servers, TXT policy records.
- Certificate Transparency: certificates issued for the domain, often including internal-sounding hostnames.
- WHOIS / RDAP: registration and contact metadata.
- Search engines and job posts: technology stack, cloud provider, team structure.
- Code repositories: accidentally committed configuration, internal URLs, API patterns.
- Breach data: reused credentials (handle lawfully and never test them without permission).
A safe workflow
- Write down the question you are answering.
- Collect only what is needed.
- Record the source and the time.
- Avoid personal data unless it is necessary and lawful.
- Do not interact with the target.
Public DNS lookups
dig example.com A
dig example.com MX
dig example.com TXT
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.