# Passive Web Reconnaissance

> Techniques for gathering web infrastructure intel without direct interaction—DNS records, WHOIS, archived content, metadata, and OSINT sources.

- **URL:** https://hackindex.io/services/web/reconnaissance/passive-web-reconnaissance
- **Path:** HTTP/HTTPS > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/services/web/reconnaissance.md)
- **Published:** 2026-03-28
- **Updated:** 2026-04-24

Passive reconnaissance collects information about a target without sending requests directly to it. The goal is to map exposed services, historical content, technology hints, and associated infrastructure before any active scanning begins. Everything here leaves no trace on the target's logs.

Results feed into [subdomain bruteforce](https://hackindex.io/services/web/reconnaissance/subdomain-bruteforce), [certificate transparency enumeration](https://hackindex.io/services/web/reconnaissance/certificate-transparency-enumeration), and [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration), and [content discovery](https://hackindex.io/services/web/enumeration/content-discovery).

Passive sources to query before touching the target:

- **Shodan** for open ports, banners, server versions, and TLS certificate data
- **Wayback Machine** for archived URLs, removed endpoints, and old config files
- **Google dorks** for indexed admin panels, directory listings, and error pages
- **DNS history and WHOIS** for old IPs, origin servers behind CDNs, and registrant info
- **GitHub** for leaked credentials, internal endpoints, and infrastructure details

## Passive Web Reconnaissance with Shodan

Shodan indexes exposed services and banners across the internet. Search for the target domain or IP to get open ports, server versions, TLS certificates, and associated hostnames without touching the target:

```bash
shodan search hostname:$DOMAIN --fields ip_str,port,org,product,version
# 10.10.10.50  80   CompanyISP  Apache  2.4.18
# 10.10.10.50  443  CompanyISP  nginx   1.18.0
# 10.10.10.51  8080 CompanyISP  Tomcat  9.0.41
```

```bash
shodan host $TARGET_IP
```

```bash
shodan search 'ssl.cert.subject.cn:"*.example.com"' --fields ip_str,port,hostnames
```

The SSL certificate search surfaces all IPs hosting certificates for the target domain, including subdomains not in DNS. Unusual ports and old server versions in Shodan results are immediate vulnerability discovery candidates.

## Wayback Machine

The Wayback Machine archives historical snapshots of web pages. Old snapshots reveal removed endpoints, legacy admin panels, old API paths, and content deleted from production:

```bash
curl -sk "https://web.archive.org/cdx/search/cdx?url=$DOMAIN/*&output=text&fl=original&collapse=urlkey&limit=500" | sort -u
# https://example.com/admin/
# https://example.com/api/v1/users
# https://example.com/backup/db.sql
# https://example.com/old-admin/login.php
```

```bash
curl -sk "https://web.archive.org/cdx/search/cdx?url=$DOMAIN/*&output=text&fl=original&collapse=urlkey&limit=500" | grep -iE '\.(php|asp|aspx|jsp|bak|sql|env|config|zip|tar|gz)$'
# https://example.com/backup/dump.sql
# https://example.com/config.php.bak
# https://example.com/.env.old
```

Filter for backup files, database dumps, and config files specifically. These are often removed from active directories but still present on the server and worth requesting directly during enumeration.

### waybackurls and gau

`waybackurls` (tomnomnom) pulls URLs from the Wayback Machine, Common Crawl, and other sources in a single call. Faster than manual CDX API queries for bulk work:

```bash
echo $DOMAIN | waybackurls | sort -u | tee wayback_urls.txt
```

`gau` (GetAllURLs) queries the same sources plus OTX and URLScan, catching URLs that waybackurls misses:

```bash
echo $DOMAIN | gau --threads 5 --subs | sort -u | tee gau_urls.txt
```

Pipe the combined output through extension and path filters to surface high-value targets for manual testing.

## Google Dorks

Google indexes publicly accessible content including configuration files, login pages, and directory listings. Run targeted dorks before any active scanning:

```bash
curl -sk "https://www.googleapis.com/customsearch/v1?key=APIKEY&cx=CX&q=site:$DOMAIN+intitle:'index+of'" | python3 -m json.tool
```

Run these dork patterns directly in a browser for the target domain:

| Dork | Finds |
| --- | --- |
| site:example.com intitle:"index of" | Directory listings |
| site:example.com ext:php inurl:admin | Admin panels |
| site:example.com ext:env OR ext:config OR ext:bak | Config and backup files |
| site:example.com intext:"sql syntax" | SQL error pages |
| site:example.com inurl:"?id=" OR inurl:"?page=" | Parameter-driven pages |
| site:example.com filetype:log | Exposed log files |

## DNS History and WHOIS

Historical DNS records reveal IP addresses the domain pointed to in the past, which often include unpatched staging servers or origin IPs hidden behind a CDN:

```bash
whois $DOMAIN | grep -iE 'registrar|creation|updated|name server|admin email'
```

```bash
curl -sk "https://api.hackertarget.com/hostsearch/?q=$DOMAIN"
# dev.example.com,10.10.10.51
# staging.example.com,10.10.10.52
# api.example.com,10.10.10.50
```

## GitHub and Code Repository Leaks

Public repositories sometimes contain hardcoded credentials, internal API endpoints, and infrastructure details. Search GitHub before touching the target:

```bash
curl -sk -H "Authorization: token $GITHUB_TOKEN" "https://api.github.com/search/code?q=$DOMAIN+password&type=code" | python3 -m json.tool | grep html_url
```

```bash
curl -sk -H "Authorization: token $GITHUB_TOKEN" "https://api.github.com/search/code?q=$DOMAIN+api_key&type=code" | python3 -m json.tool | grep html_url
```

## References

- [Shodan CLI](https://cli.shodan.io/) - Shodan command-line interface for host and service search
- [Wayback Machine CDX API](https://web.archive.org/cdx/search/) - CDX API for URL enumeration from archived snapshots
- [Google Hacking Database](https://www.exploit-db.com/google-hacking-database) - Curated collection of Google dork patterns by category
- [waybackurls](https://github.com/tomnomnom/waybackurls) - Fetches known URLs from Wayback Machine for a domain
- [gau (GetAllURLs)](https://github.com/lc/gau) - Fetches URLs from Wayback Machine, Common Crawl, OTX, and URLScan