Skip to content
HackIndex logo

HackIndex

Passive Web Reconnaissance

5 min read Apr 24, 2026

Passive reconnaissance collects information about a target without sending requests directly to it. The goal is to map exposed services, historical content, technology hints, and associated infrastructure before any active scanning begins. Everything here leaves no trace on the target's logs.

Results feed into subdomain bruteforce, certificate transparency enumeration, and virtual host enumeration.

Shodan

Shodan indexes exposed services and banners across the internet. Search for the target domain or IP to get open ports, server versions, TLS certificates, and associated hostnames without touching the target:

┌──(kali㉿kali)-[~]
└─$ shodan search hostname:$DOMAIN --fields ip_str,port,org,product,version 
10.10.10.50  80   CompanyISP  Apache  2.4.18
10.10.10.50  443  CompanyISP  nginx   1.18.0
10.10.10.51  8080 CompanyISP  Tomcat  9.0.41
Explain command
hostname:$DOMAIN Filter results to hosts matching the specified domain name.
--fields ip_str,port,org,product,version Return only the specified comma-separated fields in the output.
┌──(kali㉿kali)-[~]
└─$ shodan host $TARGET_IP
Explain command
$TARGET_IP Target IP address to query for open ports, services, and vulnerabilities.
┌──(kali㉿kali)-[~]
└─$ shodan search 'ssl.cert.subject.cn:"*.example.com"' --fields ip_str,port,hostnames
Explain command
'ssl.cert.subject.cn:"*.example.com"' Filters results to hosts with a wildcard SSL cert CN matching example.com.
--fields ip_str,port,hostnames Limits output to IP address, port, and hostnames fields only.

The SSL certificate search surfaces all IPs hosting certificates for the target domain, including subdomains not in DNS. Unusual ports and old server versions in Shodan results are immediate vulnerability discovery candidates.

Wayback Machine

The Wayback Machine archives historical snapshots of web pages. Old snapshots reveal removed endpoints, legacy admin panels, old API paths, and content deleted from production:

┌──(kali㉿kali)-[~]
└─$ curl -sk "https://web.archive.org/cdx/search/cdx?url=$DOMAIN/*&output=text&fl=original&collapse=urlkey&limit=500" | sort -u 
https://example.com/admin/
https://example.com/api/v1/users
https://example.com/backup/db.sql
https://example.com/old-admin/login.php
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
url=$DOMAIN/* Target domain wildcard pattern passed to the CDX API query.
output=text Sets CDX API response format to plain text.
fl=original Specifies CDX API field to return only the original URL field.
collapse=urlkey Deduplicates CDX results by collapsing identical URL keys.
limit=500 Restricts CDX API response to a maximum of 500 results.
-u Outputs only unique lines after sorting the piped input.
┌──(kali㉿kali)-[~]
└─$ curl -sk "https://web.archive.org/cdx/search/cdx?url=$DOMAIN/*&output=text&fl=original&collapse=urlkey&limit=500" | grep -iE '\.(php|asp|aspx|jsp|bak|sql|env|config|zip|tar|gz)$' 
https://example.com/backup/dump.sql
https://example.com/config.php.bak
https://example.com/.env.old
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections; skips certificate verification.
https://web.archive.org/cdx/search/cdx?url=$DOMAIN/*&output=text&fl=original&collapse=urlkey&limit=500 Wayback CDX API query for all URLs under $DOMAIN, limited to 500 results.
-i Case-insensitive pattern matching in grep.
-E Use extended regular expressions in grep.
\.(php|asp|aspx|jsp|bak|sql|env|config|zip|tar|gz)$ Regex matching URLs ending with sensitive or backup file extensions.

Filter for backup files, database dumps, and config files specifically. These are often removed from active directories but still present on the server and worth requesting directly during enumeration.

Google Dorks

Google indexes publicly accessible content including configuration files, login pages, and directory listings. Run targeted dorks before any active scanning:

┌──(kali㉿kali)-[~]
└─$ curl -sk "https://www.googleapis.com/customsearch/v1?key=APIKEY&cx=CX&q=site:$DOMAIN+intitle:'index+of'" | python3 -m json.tool
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
APIKEY Placeholder for the Google Custom Search API key.
CX Placeholder for the Custom Search Engine (CSE) context identifier.
q=site:$DOMAIN+intitle:'index+of' Search query targeting directory listing pages on the specified domain.
$DOMAIN Placeholder variable representing the target domain to search against.
-m json.tool Pipes JSON response through Python's built-in pretty-printer module.

Run these dork patterns directly in a browser for the target domain:

Dork

Finds

site:example.com intitle:"index of"

Directory listings

site:example.com ext:php inurl:admin

Admin panels

site:example.com ext:env OR ext:config OR ext:bak

Config and backup files

site:example.com intext:"sql syntax"

SQL error pages

site:example.com inurl:"?id=" OR inurl:"?page="

Parameter-driven pages

site:example.com filetype:log

Exposed log files

DNS History and WHOIS

Historical DNS records reveal IP addresses the domain pointed to in the past, which often include unpatched staging servers or origin IPs hidden behind a CDN:

┌──(kali㉿kali)-[~]
└─$ whois $DOMAIN | grep -iE 'registrar|creation|updated|name server|admin email'
Explain command
$DOMAIN Target domain name to query WHOIS records for.
-iE Case-insensitive search using extended regular expressions.
'registrar|creation|updated|name server|admin email' ERE pattern matching key WHOIS fields via alternation.
┌──(kali㉿kali)-[~]
└─$ curl -sk "https://api.hackertarget.com/hostsearch/?q=$DOMAIN" 
dev.example.com,10.10.10.51
staging.example.com,10.10.10.52
api.example.com,10.10.10.50
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
$DOMAIN Placeholder for the target domain name to query.

GitHub and Code Repository Leaks

Public repositories sometimes contain hardcoded credentials, internal API endpoints, and infrastructure details. Search GitHub before touching the target:

┌──(kali㉿kali)-[~]
└─$ curl -sk -H 'Authorization: token $GITHUB_TOKEN' "https://api.github.com/search/code?q=$DOMAIN+password&type=code" | python3 -m json.tool | grep html_url
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
-H 'Authorization: token $GITHUB_TOKEN' Sends GitHub personal access token as an Authorization header.
https://api.github.com/search/code?q=$DOMAIN+password&type=code GitHub code search API endpoint querying for domain-related password strings.
$GITHUB_TOKEN Placeholder for the GitHub personal access token value.
$DOMAIN Placeholder for the target domain used in the search query.
-m json.tool Runs Python's built-in JSON pretty-printer to format the API response.
html_url grep filter to extract only the html_url fields from the JSON output.
┌──(kali㉿kali)-[~]
└─$ curl -sk -H 'Authorization: token $GITHUB_TOKEN' "https://api.github.com/search/code?q=$DOMAIN+api_key&type=code" | python3 -m json.tool | grep html_url
Explain command
-s Silent mode; suppresses progress and error output.
-k Allows insecure TLS connections, skipping certificate verification.
-H 'Authorization: token $GITHUB_TOKEN' Sets Authorization header using a GitHub personal access token.
https://api.github.com/search/code?q=$DOMAIN+api_key&type=code GitHub code search API endpoint querying for domain-related api_key hits.
-m json.tool Runs Python's built-in JSON pretty-printer to format API response.
html_url Grep pattern to extract file result URLs from the JSON output.

References