# Passive Information Gathering

> Collect target information from public sources without touching the network. WHOIS, DNS records, Shodan, certificate transparency, Google dorking, and automated OSINT tools.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/passive-information-gathering
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 1.5
- **Published:** 2026-09-23
- **Updated:** 2026-09-25

Passive information gathering collects data about a target without sending any traffic to it. Everything comes from public sources: search engines, DNS records, certificate logs, and third-party databases. In a real engagement, this phase happens before you touch the target network. The techniques build a target profile that guides your active scanning.

## OSINT and Search Engine Reconnaissance

Google dorks, cached pages, and the Wayback Machine expose files, login panels, directory listings, and error messages the target may not realize are public. Combine with Shodan to find exposed services without scanning a single port.

## DNS and Subdomain Discovery

Certificate transparency logs, WHOIS records, and passive DNS databases reveal subdomains the target may not intend to be public. Each discovered subdomain is a potential new attack surface for the active phase.

## Email and Identity Gathering

Email addresses follow predictable patterns per organization. Harvesting them from public sources provides usernames for credential attacks and targets for client-side exploitation.

## Study material

- [Passive Web Reconnaissance](https://hackindex.io/services/web/reconnaissance/passive-web-reconnaissance.md) (read, core)
- [Google Dork Reconnaissance](https://hackindex.io/services/web/reconnaissance/google-dork-recon.md) (read, core)
- [Certificate Transparency Enumeration](https://hackindex.io/services/web/reconnaissance/certificate-transparency-enumeration.md) (read, core)
- [Subdomain Bruteforce](https://hackindex.io/services/web/reconnaissance/subdomain-bruteforce.md) (read, core)
- [Email Address Discovery and Harvesting](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-discovery.md) (read, core)