Skip to main content
Before sending a single crafted request at a target website, passive recon pulls together what’s already public: DNS footprint, subdomains, technology stack, and anything search engines or archives have already indexed. None of this touches the application itself, so it’s the natural first step of any web engagement.
This page covers the command-line and tool side of web recon. For the browser-based/website tools (WHOIS lookups, Certificate Transparency search, dnsdumpster, Have I Been Pwned, Google dorking, Wayback Machine, and the rest) see the OSINT cheatsheet instead, they aren’t repeated here.

Passive Recon

Gathered through DNS, search engines, and third-party tools. The target never sees a request from you.

Active Recon

Directly probing the site itself (directory brute-forcing, vuln scanning, parameter testing). Covered on later Web Enumeration pages.

​
DNS Resolution

Basic DNS lookups confirm the IP a domain resolves to and which name servers are authoritative for it, the starting point before anything else.
A trace walks the full resolution path from the root servers down, useful if you suspect a stale or split-horizon DNS setup.
dnsrecon goes further than a one-off lookup, it enumerates NS/MX/TXT/SOA records in one pass and can brute-force subdomains against a wordlist.

​
Domain Ownership

For the web-based WHOIS and hosting-history lookups (who.is, Netcraft) see the OSINT cheatsheet, this is just the CLI equivalent.

​
Subdomain Enumeration

Subdomains often run older software, staging environments, or admin panels that never made it onto the main domain’s radar. Sublist3r and theHarvester both pull from public sources rather than touching the target directly.
theHarvester casts wider than just subdomains, it also pulls emails and other OSINT artifacts tied to the domain from search engines and public sources.
Pull historical URLs from the Wayback Machine for the domain, old parameters, forgotten endpoints, and leftover files often show up here long after they’re removed from the live site.

​
Technology Fingerprinting

Knowing the stack (CMS, web server, JS frameworks, analytics) up front narrows down which known vulnerabilities and default paths are worth checking later.
Wappalyzer (browser extension) gives you the same kind of fingerprint passively while you’re just browsing the site, no extra command needed.

​
WAF Detection

Knowing a WAF sits in front of the target before you start testing saves time, it explains odd blocked responses and tells you payloads will likely need obfuscation or tampering.

​
Mirroring the Site Locally

Downloading a full local copy lets you grep through HTML, JS, and comments offline instead of pulling pages one at a time, useful for spotting hardcoded API keys, internal hostnames, or leftover comments in the source.

​
Website Routes Worth Checking

Two files are worth checking on virtually every site, both are usually unauthenticated and often leak more than intended (internal paths, staging domains, disallowed-but-sensitive directories).

​
Quick Reference Tools

OSINT Cheatsheet

WHOIS, Certificate Transparency, dnsdumpster, breach search, and the other website-based recon tools.

theHarvester

Email, subdomain, and OSINT aggregation from search engines and public sources.

Sublist3r

Passive subdomain enumeration with an optional brute-force mode.

WhatWeb

Web technology fingerprinting from the command line.

wafw00f

Identifies which WAF, if any, sits in front of a target.

Wappalyzer

Browser extension for passive technology fingerprinting.
Passive recon is low-risk but not zero-risk, some lookups (theHarvester’s search engine queries, brute-force subdomain modes) do generate traffic that a well-monitored target can see. Stay within what’s in scope, and keep in mind everything here is just the groundwork, not an assessment on its own.