This guide is currently under development, and I greatly welcome any suggestions or feedback or at reaper.gitbook@gmail.com

Passive Reconnaissance

Methodology Framework

This methodology follows established OSINT frameworks for systematic information gathering without direct target interaction, ensuring zero detection while maximizing intelligence collection.

Reconnaissance Flow

Target Identification → Domain Intelligence → Infrastructure Enumeration → Technology Analysis → Human Intelligence → Digital Assets → Analysis

Phase 1: Target Identification

1.1 Organization Profiling

Objective: Establish comprehensive organizational context and scope

Step 1.1.1: Business Registration Lookup

  • Execute whois target.com for domain registration details

  • Execute whois target-ip-range for network allocation information

  • Research corporate structure through business registration databases

Step 1.1.2: Corporate Structure Research Manual research areas include:

  • SEC filings and annual reports

  • Business registration databases

  • Parent and subsidiary relationships

  • Recent acquisitions and mergers

  • Corporate governance structure

1.2 Initial Domain Enumeration

Objective: Identify primary domains and naming conventions

Step 1.2.1: Root Domain Validation

  • Query dig target.com A for IPv4 addresses

  • Query dig target.com AAAA for IPv6 addresses

  • Query dig target.com MX for mail server records

  • Query dig target.com NS for name server information

Step 1.2.2: Alternative Domain Discovery Research domain variations including:

  • Alternative TLDs: target.org, target.net, target.biz

  • Corporate variations: target-corp.com, targetcompany.com

  • Regional variations: target-uk.com, eu.target.com

  • Acquired company domains from merger history

1.3 Scope Definition

Objective: Define reconnaissance boundaries and prioritization

Asset Priority Matrix:

Priority
Asset Type
Examples

Critical

Primary domains, main infrastructure

target.com, www.target.com

High

Subdomains, email systems

mail.target.com, api.target.com

Medium

Development environments

dev.target.com, staging.target.com

Low

Legacy domains, archived sites

old.target.com, archive.target.com

Phase 2: Domain Intelligence

2.1 DNS Infrastructure Analysis

Objective: Map DNS infrastructure and hosting relationships

Step 2.1.1: Name Server Analysis

  • Execute dig target.com NS to identify authoritative name servers

  • Execute dig target.com SOA for zone authority information

  • Analyze name server hosting patterns and providers

Step 2.1.2: MX Record Analysis

  • Execute dig target.com MX for mail server configuration

  • Identify mail hosting providers and security services

  • Analyze mail server priority and redundancy

Step 2.1.3: TXT Record Enumeration

  • Execute dig target.com TXT for policy and verification records

  • Identify SPF, DKIM, and DMARC configurations

  • Discover verification tokens for third-party services

Step 2.1.4: Historical DNS Data Research historical DNS information using:

  • SecurityTrails for DNS history analysis

  • DNSdumpster for comprehensive DNS mapping

  • Wayback Machine for historical DNS records

  • PassiveTotal for infrastructure correlation

2.2 Subdomain Discovery

Objective: Enumerate all discoverable subdomains

Step 2.2.1: Certificate Transparency Logs

  • Query certificate transparency databases using curl -s "https://crt.sh/?q=%.target.com&output=json"

  • Extract subdomain information from SSL certificates

  • Analyze certificate issuance patterns and authorities

Step 2.2.2: Search Engine Enumeration Google search operators for subdomain discovery:

  • site:target.com -www to exclude main domain

  • site:*.target.com to find subdomain references

  • inurl:target.com to find URL patterns

Step 2.2.3: Dictionary-Based Discovery Common subdomain patterns to research:

  • Administrative: admin, management, control, console

  • Development: dev, test, staging, beta, demo

  • Services: api, mail, ftp, vpn, portal, cdn

  • Departments: hr, finance, sales, support, marketing

  • Geographic: us, uk, eu, asia, americas

2.3 Domain Relationships

Objective: Map domain relationships and trust boundaries

Step 2.3.1: Related Domain Discovery Research naming pattern variations:

  • Division-based domains: target-[division].com

  • Geographic domains: [country].target.com, target.[country]

  • Temporal domains: target[year].com, target-[quarter].com

  • Product domains: [product].target.com

Step 2.3.2: Acquisition Research

  • Identify recently acquired companies through business intelligence

  • Check for maintained separate domain infrastructure

  • Research integration timelines and migration patterns

Phase 3: Infrastructure Enumeration

3.1 IP Address Intelligence

Objective: Map IP infrastructure and hosting providers

Step 3.1.1: IP Address Resolution

  • Execute dig target.com A for IPv4 address mapping

  • Execute dig target.com AAAA for IPv6 address information

  • Document all resolved IP addresses with timestamps

Step 3.1.2: Reverse DNS Enumeration

  • Execute dig -x target-ip for reverse DNS resolution

  • Identify hostname patterns and naming conventions

  • Map IP-to-hostname relationships

Step 3.1.3: IP Range Analysis

  • Execute whois target-ip for network allocation details

  • Identify hosting provider and geographic location

  • Determine allocated IP range and subnet information

  • Research ASN (Autonomous System Number) details

3.2 Hosting and Cloud Provider Analysis

Objective: Identify hosting infrastructure and cloud services

Step 3.2.1: Hosting Provider Identification Analyze infrastructure components:

  • ASN information for network ownership

  • IP geolocation for data center locations

  • Hosting company business relationships

  • Service level and infrastructure tier analysis

Step 3.2.2: Cloud Service Detection Identify cloud platform indicators:

  • AWS: amazonaws.com, cloudfront.net, s3.amazonaws.com

  • Azure: azurewebsites.net, azure.com, blob.core.windows.net

  • Google Cloud: googleusercontent.com, appspot.com, googleapis.com

  • Cloudflare: cloudflare.com, cdnjs.cloudflare.com

Phase 4: Technology Stack Analysis

4.1 Web Technology Fingerprinting

Objective: Identify web technologies without direct scanning

Step 4.1.1: HTTP Header Analysis Analyze publicly cached headers from sources including:

  • Wayback Machine for historical header information

  • Search engine cached pages

  • Third-party scanning service results

  • Security research databases

Step 4.1.2: Technology Indicators Identify technology patterns in public content:

  • URL patterns: /wp-content/ indicates WordPress

  • File extensions: .aspx indicates ASP.NET

  • Error pages revealing server information

  • Default installation content and pages

4.2 Third-Party Service Integration

Objective: Identify integrated third-party services

Step 4.2.1: JavaScript Library Analysis From cached pages and public content, identify:

  • jQuery versions and implementation patterns

  • Bootstrap versions and customization

  • Analytics tracking codes and configuration

  • CDN-hosted library versions and sources

Step 4.2.2: API and Service Discovery Research references to external services:

  • Payment processors: Stripe, PayPal, Square

  • Analytics platforms: Google Analytics, Mixpanel, Adobe

  • Customer support: Zendesk, Intercom, Freshdesk

  • Marketing automation: Mailchimp, HubSpot, Marketo

  • Cloud services: AWS, Azure, Google Cloud integrations

4.3 Software Version Intelligence

Objective: Determine software versions for vulnerability research

Version Discovery Sources:

  • Generator meta tags in HTML source code

  • CSS and JavaScript file naming conventions

  • Error pages and debug information disclosure

  • Job postings mentioning specific technology versions

  • Developer blog posts and technical documentation

  • Conference presentations and technical talks

Phase 5: Human Intelligence Gathering

5.1 Employee Enumeration

Objective: Build comprehensive employee database

Step 5.1.1: LinkedIn Intelligence Gather professional information including:

  • Employee names, titles, and department assignments

  • Organizational structure and reporting relationships

  • Tenure information and career progression

  • Technical skills and technology expertise

  • Professional connections and network analysis

Step 5.1.2: Social Media Analysis Research employee presence on platforms:

  • Twitter for technical discussions and opinions

  • GitHub for personal and professional code repositories

  • Professional forums and technical communities

  • Industry conferences and speaking engagements

  • Technical blogs and publication contributions

5.2 Email Pattern Analysis

Objective: Determine email addressing conventions

Common Email Patterns:

Pattern
Example
Usage

first.last

john.doe@target.com

Most common

firstlast

johndoe@target.com

Common

first_last

john_doe@target.com

Less common

flast

jdoe@target.com

Abbreviation

first

john@target.com

Small organizations

Pattern Validation Methods:

  • LinkedIn contact information analysis

  • Corporate directory research

  • Press release contact information

  • Conference registration data

  • Public email signatures

5.3 Organizational Structure Mapping

Objective: Understand business hierarchy and relationships

Intelligence Sources:

  • LinkedIn company pages and employee listings

  • Press releases and corporate announcements

  • SEC filings and regulatory documents

  • Annual reports and investor presentations

  • Conference speaker biographical information

  • Industry publication author profiles

Phase 6: Digital Asset Discovery

6.1 Search Engine Intelligence

Objective: Discover exposed information through search engines

Google Dorking Methodology

6.1.1 Administrative Interface Discovery

Administrative Panels:

  • site:target.com inurl:admin

  • site:target.com intitle:"Admin Panel"

  • site:target.com inurl:wp-admin

  • site:target.com inurl:phpmyadmin

  • site:target.com inurl:cpanel

Login Interfaces:

  • site:target.com inurl:login

  • site:target.com intitle:"Login"

  • site:target.com "administrative interface"

6.1.2 Configuration File Exposure

Environment Files:

  • site:target.com filetype:env

  • site:target.com filetype:env "DB_PASSWORD"

  • site:target.com filetype:env "API_KEY"

Configuration Files:

  • site:target.com filetype:config

  • site:target.com filetype:yml "secret"

  • site:target.com filetype:json "password"

  • site:target.com filetype:properties

6.1.3 Database and Backup Discovery

Database Files:

  • site:target.com filetype:sql

  • site:target.com filetype:sql "CREATE TABLE"

  • site:target.com filetype:db

Backup Files:

  • site:target.com filetype:bak

  • site:target.com filetype:backup

  • site:target.com filetype:old

  • site:target.com inurl:backup "Index of"

6.1.4 Directory Listing Enumeration

Directory Browsing:

  • site:target.com intitle:"Index of /" "Parent Directory"

  • site:target.com intitle:"Directory Listing For"

  • site:target.com inurl:"/uploads/" "Index of"

  • site:target.com inurl:"/.git/" "index"

6.1.5 Error Message Harvesting

Database Errors:

  • site:target.com "mysql_fetch_array()"

  • site:target.com "mysqli_connect"

  • site:target.com "PostgreSQL query failed"

  • site:target.com "Microsoft OLE DB Provider"

  • site:target.com "Warning: mysql_"

Application Errors:

  • site:target.com "Fatal error"

  • site:target.com "Warning:"

  • site:target.com "Parse error"

  • site:target.com "Notice:"

6.1.6 API Documentation Discovery

API Endpoints:

  • site:target.com inurl:api/v1

  • site:target.com inurl:api/v2

  • site:target.com inurl:rest

  • site:target.com inurl:graphql

Documentation:

  • site:target.com "swagger" OR "openapi"

  • site:target.com "API Documentation"

  • site:target.com intitle:"API" "documentation"

6.2 Code Repository Analysis

Objective: Discover sensitive information in public repositories

Step 6.2.1: GitHub Organization Discovery Search methodology includes:

  1. Official organization account identification

  2. Employee personal repository analysis

  3. Forked repository examination

  4. Archived project investigation

Step 6.2.2: Sensitive Data Patterns Repository content analysis for:

  • Domain references: "target.com" in configuration files

  • Database connection strings and credentials

  • API keys, tokens, and authentication secrets

  • Private keys and certificate materials

  • Internal URLs and hostname references

GitHub Search Operators:

Organization Repositories:

  • org:target-company

  • user:target-company

Domain References in Code:

  • "target.com" language:javascript

  • "target.com" language:python

  • "target.com" language:php

Credential Patterns:

  • "password" "target.com"

  • "api_key" "target.com"

  • "secret" "target.com"

Phase 7: Intelligence Analysis

7.1 Data Correlation and Validation

Objective: Cross-reference and validate collected intelligence

Step 7.1.1: Source Cross-Validation Verification process includes:

  • DNS records validation against certificate transparency logs

  • Employee information verification across multiple platforms

  • Technology indicators confirmation through multiple sources

  • Infrastructure mapping validation through independent sources

Step 7.1.2: Temporal Analysis Information freshness assessment:

  • Recent DNS record changes and patterns

  • New employee additions and departures

  • Technology stack updates and migrations

  • Infrastructure modifications and expansions

7.2 Threat Modeling and Prioritization

Objective: Assess and prioritize discovered intelligence

Risk Assessment Matrix:

Finding Type
Risk Level
Priority

Exposed credentials

Critical

Immediate

Admin interfaces

High

High

Development environments

High

High

Employee information

Medium

Medium

Technology versions

Medium

Research

General infrastructure

Low

Background

7.3 Attack Vector Development

Objective: Transform intelligence into actionable attack vectors

Intelligence-to-Attack Mapping:

  • Subdomain Discovery → Targeted scanning scope definition

  • Technology Fingerprinting → Specific exploit research and development

  • Employee Intelligence → Social engineering vector development

  • Credential Discovery → Direct access attempt planning

  • Administrative Interfaces → Authentication testing preparation

PreviousPre-Engagement ActivitiesNextActive Reconnaissance

Last updated

Was this helpful?