Skip to content
HackIndex.io

Hosts:

Reconnaissance

Guides for mapping hosts via passive OSINT, network sweeps, and active prob

3 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
3 guides

Passive Reconnaissance

Discover exposed host information using passive techniques—DNS enumeration, WHOIS lookups, and OSINT tools—without directly interacting with the target infrastructure.

Dec 29, 2025 • 4 min read

Host reconnaissance is the passive phase: gathering information about targets without sending them a single packet. OSINT, public records, and exposed infrastructure tell you what exists before you scan anything.

IP range identification through WHOIS, BGP data, and DNS records maps the target's network footprint. Search engines, certificate transparency logs, and Shodan reveal publicly exposed services and forgotten infrastructure.

Start here to build your target list and understand the scope before moving into active enumeration.