Passive recon involves collecting information about a target without directly interacting with their systems. This leaves no footprint and is often the safest starting point. Sources include public websites, social media, DNS records, WHOIS data, job listings, and leaked databases.
OSINT Sources
- WHOIS Lookup — Reveals domain registration info, registrant name, email, address
- DNS Records — A, MX, NS, CNAME, TXT records reveal infrastructure details
- io — Search engine for internet-connected devices (cameras, servers, IoT)
- LinkedIn — Reveals employee names, job roles, technologies used
- GitHub — Source code repositories may contain exposed API keys, credentials
- Google Cache / Wayback Machine — Access old versions of websites
Google Dorking Cheat Sheet
|
Dork Operator |
Syntax Example |
What It Finds |
|
site: |
site:example.com |
All indexed pages of a domain |
|
filetype: |
filetype:pdf site:gov.in |
PDF files on government sites |
|
intitle: |
intitle:index of passwords |
Directory listing pages |
|
inurl: |
inurl:admin login |
Admin login pages |
|
cache: |
cache:example.com |
Google’s cached version of a page |
|
⚠️ Legal Warning: Google Dorking itself is legal — but exploiting the information found (accessing unauthorized systems, downloading private files) is a criminal offense under the IT Act. Always use these techniques only on systems you own or have permission to test. |
Lab: theHarvester Tool
- Command: theHarvester -d example.com -b google,bing,linkedin
- This tool automatically collects emails, subdomains, hosts, and employee names
- Practice on a domain you own or use a CTF practice environment