> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Passive Information Gathering

Before sending a single crafted request at a target website, passive recon pulls together what's already public: DNS footprint, subdomains, technology stack, and anything search engines or archives have already indexed. None of this touches the application itself, so it's the natural first step of any web engagement.

> [!NOTE]
>
> This page covers the command-line and tool side of web recon. For the browser-based/website tools (WHOIS lookups, Certificate Transparency search, dnsdumpster, Have I Been Pwned, Google dorking, Wayback Machine, and the rest) see the [OSINT cheatsheet](https://0-x.dev/osint.md) instead, they aren't repeated here.

> **Passive Recon**
>
> Gathered through DNS, search engines, and third-party tools. The target never sees a request from you.

> **Active Recon**
>
> Directly probing the site itself (directory brute-forcing, vuln scanning, parameter testing). Covered on later Web Enumeration pages.

***

## DNS Resolution

Basic DNS lookups confirm the IP a domain resolves to and which name servers are authoritative for it, the starting point before anything else.

```text theme={null}
host test-website.com
nslookup domain.com
dig example.com
```

A trace walks the full resolution path from the root servers down, useful if you suspect a stale or split-horizon DNS setup.

```text theme={null}
dig +trace domain.com
```

> [!TIP]
>
> `dnsrecon` goes further than a one-off lookup, it enumerates NS/MX/TXT/SOA records in one pass and can brute-force subdomains against a wordlist.
>
> ```text theme={null}
> dnsrecon -d test-website.com
> ```

***

## Domain Ownership

```text theme={null}
whois test-website.com    # registrant, registrar, nameservers, and registration dates
```

> [!NOTE]
>
> For the web-based WHOIS and hosting-history lookups (who.is, Netcraft) see the [OSINT cheatsheet](https://0-x.dev/osint.md), this is just the CLI equivalent.

***

## Subdomain Enumeration

Subdomains often run older software, staging environments, or admin panels that never made it onto the main domain's radar. Sublist3r and theHarvester both pull from public sources rather than touching the target directly.

```text theme={null}
sublist3r -d test-website.com       # passive by default, pulls from search engines and public DBs
sublist3r -d test-website.com -b    # add -b to brute-force subdomains instead, this is active, not passive
```

theHarvester casts wider than just subdomains, it also pulls emails and other OSINT artifacts tied to the domain from search engines and public sources.

```text theme={null}
theHarvester -d test-website.com -b all
```

> [!TIP]
>
> Pull historical URLs from the Wayback Machine for the domain, old parameters, forgotten endpoints, and leftover files often show up here long after they're removed from the live site.
>
> ```text theme={null}
> waybackurls domain.com
> ```

***

## Technology Fingerprinting

Knowing the stack (CMS, web server, JS frameworks, analytics) up front narrows down which known vulnerabilities and default paths are worth checking later.

```text theme={null}
whatweb test-website.com
```

> [!TIP]
>
> Wappalyzer (browser extension) gives you the same kind of fingerprint passively while you're just browsing the site, no extra command needed.

***

## WAF Detection

Knowing a WAF sits in front of the target before you start testing saves time, it explains odd blocked responses and tells you payloads will likely need obfuscation or tampering.

```text theme={null}
wafw00f test-website.com
wafw00f test-website.com -a    # check against all signatures instead of stopping at the first match
```

***

## Mirroring the Site Locally

Downloading a full local copy lets you grep through HTML, JS, and comments offline instead of pulling pages one at a time, useful for spotting hardcoded API keys, internal hostnames, or leftover comments in the source.

```text theme={null}
webhttrack
```

***

## Website Routes Worth Checking

Two files are worth checking on virtually every site, both are usually unauthenticated and often leak more than intended (internal paths, staging domains, disallowed-but-sensitive directories).

```text theme={null}
/robots.txt     # disallowed paths, often reveals admin/staging paths meant to stay out of search indexes
/sitemap.xml    # full site structure, sometimes includes pages with no other inbound links
/security.txt 	 # check report / bug bounty site, this can reveal useful informations
```

***

## Quick Reference Tools

> **[OSINT Cheatsheet](https://0-x.dev/osint.md)**
>
> WHOIS, Certificate Transparency, dnsdumpster, breach search, and the other website-based recon tools.

> **[theHarvester](https://github.com/laramies/theHarvester)**
>
> Email, subdomain, and OSINT aggregation from search engines and public sources.

> **[Sublist3r](https://github.com/aboul3la/Sublist3r)**
>
> Passive subdomain enumeration with an optional brute-force mode.

> **[WhatWeb](https://github.com/urbanadventurer/WhatWeb)**
>
> Web technology fingerprinting from the command line.

> **[wafw00f](https://github.com/EnableSecurity/wafw00f)**
>
> Identifies which WAF, if any, sits in front of a target.

> **[Wappalyzer](https://www.wappalyzer.com/)**
>
> Browser extension for passive technology fingerprinting.

> [!WARNING]
>
> Passive recon is low-risk but not zero-risk, some lookups (theHarvester's search engine queries, brute-force subdomain modes) do generate traffic that a well-monitored target can see. Stay within what's in scope, and keep in mind everything here is just the groundwork, not an assessment on its own.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.