Typorithm · medium

Passive OSINT

passive-osintpentestosintpassiverecon

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Passive OSINT

Recon & OSINT

Passive OSINT gathers intelligence about an authorized target without sending any traffic to it. WHOIS, certificate transparency (crt.sh), Shodan, and email/host OSINT (theHarvester, amass -passive) build the attack-surface map before any active testing — low-risk and effectively undetectable by the target.

Reconnaissance is the first phase of an authorized, scoped engagement. Passive recon collects data without ever contacting the target's infrastructure, so the target sees no traffic and the engagement leaves no footprint at this stage.

Sources are all third-party or public: WHOIS registration records, certificate transparency logs (crt.sh), Shodan's index of internet-facing services, and search-engine scraping for employee emails and hostnames via theHarvester.

amass enum -passive aggregates subdomains from these external datasets rather than probing DNS at the target. The output is an attack-surface map — domains, hosts, emails, and exposed services — used to plan active testing that stays inside the agreed scope.

Passive recon sends no traffic to the target.

Sources: WHOIS, crt.sh, Shodan, theHarvester.

amass -passive uses external datasets only.

whois target.com
theHarvester -d target.com -b all
amass enum -passive -d target.com
# crt.sh, Shodan, Google dorks (no traffic)

Read the implementation

Connect each part of the code to the concept before you type.

1. WHOIS lookup

whois queries public registration records — owner, registrar, and creation dates — without touching the target's own servers.

whois target.com

2. Email/host OSINT

theHarvester scrapes search engines and public sources for employee emails, hostnames, and subdomains tied to the domain.

theHarvester -d target.com -b all

3. Passive subdomains

amass with -passive pulls subdomains from third-party datasets and certificate logs, never querying the target directly.

amass enum -passive -d target.com

4. Public sources

crt.sh (certificate transparency), Shodan, and Google dorks surface exposed assets from data already indexed by others — no traffic to the target.

# crt.sh, Shodan, Google dorks (no traffic)

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.