Bug › Module 4 › Lesson 1
Passive First
Passive recon gathers without direct probing — start on $SCOPE_HOST program assets, never random sites.
Visual · bounty_passive_first
Passive first literacy. $SCOPE_HOST only. Original Cyberlium.
Opening
Passive does not mean passive authorization. Scope still governs every source.
Passive reconnaissance uses third-party data, certificate transparency, DNS history, and archived pages — ideally minimizing direct packets to the target. Active recon sends probes and belongs only on in-scope $SCOPE_HOST after scope and rate limits are confirmed. Bounty hunters start passive to map surface area before touching production. Cyberlium teaches passive-first discipline on YOUR enrolled program. You will NOT Shodan-browse stranger infrastructure as 'passive homework' or treat passive OSINT on classmates as bounty prep. Next: Subdomains In-Scope Only.
1. Passive: gather with minimal target load
Examples on $SCOPE_HOST: certificate transparency for in-scope domains, DNS records for listed hostnames, public program scope docs, archived pages of in-scope URLs. Passive reduces load but still requires program enrollment and scope compliance.
OSINT on strangers — doxing classmates, scraping neighbor profiles — is out of scope and harmful. Not bounty literacy.
Command guide
Try these commands — Passive: gather with minimal target load
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Subfinder — https://github.com/projectdiscovery/subfinder (in-scope domain only) Subdomain enum — published scope required
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest sudo apt install curl
macOS:
Command — copy this
brew install subfinder
Windows:
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env"
echo "${IN_SCOPE:-httpbin.org}" | sed 's/\*\.//' > "$HOME/cyberlium-lab/t20-root-domain.txt"
subfinder -d "$(cat "$HOME/cyberlium-lab/t20-root-domain.txt")" -silent 2>/dev/null | head -15 || curl -sS "https://$SCOPE_HOST/get?subfinder=literacy" | head -5Primary tools to practice this lesson: subfinder, curl. Reference sites: Subfinder (https://github.com/projectdiscovery/subfinder); Subdomain enum. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Active comes after passive map
Once passive sources list candidate hosts, cross-check each against in-scope table before any probe. Log commands, timestamps, and rate limits in $HOME/cyberlium-lab notes.
Active recon on dorm /24, café gateways, or classmate deploys violates program rules — regardless of tool sophistication.
3. Label techniques in notes
Bounty reports distinguish passive intel from active findings. Notes should tag each step: passive vs active, source, scope reference ($SCOPE_HOST).
Ship: two-row table — one passive example on $SCOPE_HOST, one active example deferred until scope confirmed. Next: Subdomains In-Scope Only.
4. What you ship: passive-first recon plan for $SCOPE_HOST
Passive sources list. Active deferred until in-scope check. $SCOPE_HOST only. NEVER stranger OSINT. chmod 600.
5. What you record before the next lesson
Date. Passive/active plan. $SCOPE_HOST named. File t20-m04-l01-passive-first.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Call Shodan on stranger IPs 'passive.' Skip passive and nmap random sites immediately.
Right
Write passive-first plan for $SCOPE_HOST. Next: Subdomains In-Scope Only.
Mission: draft passive-first plan
1) List three passive sources for $SCOPE_HOST. 2) Write in-scope check before any active step. 3) List NEVER stranger OSINT. 4) chmod 600. Never active-scan hosts not confirmed in scope.
Stuck? Ask Cyberlium AI Mentor
Passive first saves production load and triage goodwill.
Knowledge Check
APPLY: Passive-first bounty recon on Cyberlium starts with:
Multiple choice
Knowledge Check
APPLY: True or False: Passive recon never requires scope or enrollment.
True or False
Knowledge Check
APPLY: Active recon before in-scope confirmation is:
Multiple choice