Before a penetration tester runs a single exploit, they spend a significant amount of time just watching. Collecting. Mapping. This phase is called reconnaissance — and the passive version of it is particularly interesting because you gather real intelligence about a target without sending a single packet to it.
I spent a session doing exactly that, targeting google.com using five different reconnaissance techniques: autonomous system lookup, Shodan searches, WHOIS queries, DNS enumeration with Sublist3r and Fierce, and SSL certificate inspection.
What came back was more than I expected. This article walks through everything I did and what each tool revealed.
What Is Passive Reconnaissance?
Passive reconnaissance means gathering information about a target using publicly available data sources — without directly interacting with the target's infrastructure. You are not scanning their servers, not sending probes, not triggering their IDS.
