OSCP · Module 2
Passive Information Gathering
Collect target information from public sources without touching the network. WHOIS, DNS records, Shodan, certificate transparency, Google dorking, and automated OSINT tools.
~1.5 h 5 resources Last updated September 25, 2026
Passive information gathering collects data about a target without sending any traffic to it. Everything comes from public sources: search engines, DNS records, certificate logs, and third-party databases. In a real engagement, this phase happens before you touch the target network. The techniques build a target profile that guides your active scanning.
OSINT and Search Engine Reconnaissance
Google dorks, cached pages, and the Wayback Machine expose files, login panels, directory listings, and error messages the target may not realize are public. Combine with Shodan to find exposed services without scanning a single port.
DNS and Subdomain Discovery
Certificate transparency logs, WHOIS records, and passive DNS databases reveal subdomains the target may not intend to be public. Each discovered subdomain is a potential new attack surface for the active phase.
Email and Identity Gathering
Email addresses follow predictable patterns per organization. Harvesting them from public sources provides usernames for credential attacks and targets for client-side exploitation.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.