Passive Recon: What the Internet Already Says

Passive recon, as this course uses the word, is collection from sources that were already meant to be public: a homepage, a robots.txt that the site itself serves to anyone, a job posting the company published, WHOIS and DNS answers that registries and resolvers give out as part of how the internet works. The test is not “I did not log in.” The test is “I did not send a crafted probe, a scan, a login guess, or a dork aimed at someone else’s private surface.” Visiting https://example.com in a browser, or asking a recursive resolver for example.com A records, is literacy on a designated example name. Walking Shodan for “webcam default password” or building Google queries like inurl:admin site:someone-elses-bank is not a lab. Those queries are how people hunt strangers. This path does not teach that hunt.

A useful picture: a shop puts its hours on the door and a help-wanted sign in the window. Reading the hours and the sign is passive. Jiggling the back lock “to see if it is a real door” is active. Calling every other shop on the street because you are “in training” is still not your assignment. example.com exists so documentation and courses have a name that is safe to type. A domain you registered and pay for is yours. A classmate’s blog, a café landing page, a school portal, and a random .gov are not yours. If you cannot say in one sentence why the name is in scope, it is not in scope.

cat >> "$NOTES" << 'EOF'
passive_means: read published pages/jobs/DNS — do not probe strangers
shop_picture: hours on the door = passive; jiggling the back lock = active
allowed: example.com OR a domain I own
EOF

Public pages leak more than marketing copy. A homepage title and a Server or CSP header (you already practiced reading those on example.com in Topic 7) tell you the site is alive and how it describes itself. A /about page may name a city. A careers page on a company YOU run may list “we hire Python and AWS” — that is a footprint of YOUR org, useful when you later write a defender report about what you published. On example.com, the lesson is the habit: one GET or one browser visit, write the title and the status code, stop. You do not spider every link. You do not follow into login forms. You do not paste other people’s employee names into a dossier.

Job posts are famous in recon talks because they name tools. That fame is not a hall pass. You may read a careers page on a domain you own, or note conceptually that “a public job ad can mention a stack.” You may not harvest LinkedIn of a company you do not work for as a Cyberlium homework pile, and you may not dork for resumes of strangers. DNS is the cleaner public channel for this lesson: names, mail exchangers, and name servers are published so the internet can route. Lesson 3 will run nslookup and whois against example.com. Lesson 1 only needs you to treat DNS as a footprint source, not as a zone-transfer attack kit. AXFR against random domains is out. Shodan against hosts you do not own is out. Google dorks aimed at other people’s login pages are out.

sudo apt install curl
sudo apt install python3

brew install python3

curl -sS -m 8 -I "https://example.com/" | head -n 20

python3 - << 'PY'
from urllib.request import Request, urlopen
url = 'https://example.com/'
raw = urlopen(Request(url, headers={'User-Agent':'CyberliumPassiveRecon/1.0'}), timeout=8).read(4096)
low = raw.decode('utf-8','replace').lower()
print('status_bytes', len(raw), 'has_title', '<title>' in low)
print('ethics: example.com or MY domain; no login dorks; no Shodan')
PY

Write the allowed list on paper before you open a terminal. (1) example.com — reserved for examples; one polite GET or a DNS lookup is the course default. (2) A domain you registered, whose registrar account you control, whose bills you pay. Optional later: a lab VM whose hostname you created. That is the whole list for Module 2. Not the café. Not the ISP CPE. Not school.edu. Not a news site you like. Not “any host that answers ping.” Skill does not create consent. A public website is still someone else’s computer. Reading their marketing is one thing; turning their site into a recon lab with dorks, scrapers, and Shodan is another. This course picks the first and forbids the second.

If you do not own a domain, you still complete the lesson on example.com. Do not “borrow” a friend’s hostname. Do not pick a random blog because example.com felt too easy. Easy is the point: you are learning the ethics of the map, not filling a binder with other people’s facts. Notes go to $HOME/cyberlium-lab with chmod 600 — the same hygiene as Topics 2, 6, 7, and 8. The file holds YOUR observations of an allowed name. It does not hold a classmate’s email, a scraped staff directory, or a Shodan screenshot of a stranger’s camera.

cat >> "$NOTES" << 'EOF'
allowed_1: example.com (IETF example host)
allowed_2: (a domain I registered — or n/a)
not_allowed: classmate blog, cafe portal, school.edu, random .gov
EOF

A footprint note is boring on purpose. Domain. Date (UTC). Source (browser, one GET, or DNS). Homepage title or “n/a.” HTTP status if you fetched. One-line ethics: “example.com or a domain I own; no dorks of other logins; no Shodan of random hosts; no neighbor.” Empty files fail. Files that list other people’s staff fail even if the data was “public.” Public-to-the-web is not the same as in-scope-for-this-course. chmod 600 so another local account does not read your lab tree. You will expand the same file in Lessons 3 and 4 with WHOIS and DNS rows. Start the habit now so the lab is fill-in, not invention.

A useful failure: you fetch example.com, get 200, write the title, and feel that the lesson is “too small.” That feeling is how people graduate into unauthorized recon. The skill is stopping. Next lesson will make the stop even sharper: when your packet is a probe, you need writing that says you may send it. Passive recon is the warm-up that proves you can collect without hunting.

On a computer you own, create cyberlium-lab if needed. Optional: one timed GET to https://example.com (or YOUR domain). Write the notes file. If you skip the GET and only record “I will use DNS in Lesson 3,” that is still valid for this lesson’s ethics — fill the definitions. Do not add a second host because example.com was boring. chmod 600. The script below refuses any host other than example.com unless you set OWNED_DOMAIN to a name you truly control; it never becomes a crawler.

sudo apt install python3
sudo apt install dnsutils

brew install python3

cd "$HOME/cyberlium-lab"

cat > passive_recon_fetch.py << 'PY'
from urllib.request import Request, urlopen
from urllib.error import URLError, HTTPError

HOST = "example.com"

ALLOWED = {"example.com"}

if HOST not in ALLOWED:
raise SystemExit("refusing host — Module 2 allows example.com or a domain YOU own")

url = f"https://{HOST}/"
req = Request(url, method="GET", headers={"User-Agent": "CyberliumPassiveRecon/1.0"})
try:
with urlopen(req, timeout=8) as resp:
    status = resp.status
    raw = resp.read(4096)  # cap — not a full-site scrape
    title = ""
    lower = raw.decode("utf-8", errors="replace")
    if "<title>" in lower.lower():
        start = lower.lower().index("<title>") + 7
        end = lower.lower().find("</title>", start)
        title = lower[start:end].strip()[:120] if end > start else ""
    print("host:", HOST)
    print("url:", url)
    print("status:", status)
    print("title:", title or "(no title in first 4k)")
    print("ethics: public page of allowed name; no dorks; no Shodan; no neighbor")
except HTTPError as e:
print("host:", HOST)
print("http_error:", e.code)
except URLError as e:
print("fetch_failed:", e.reason)
print("still valid: write notes from a browser visit or skip fetch and use DNS later")
PY

python3 passive_recon_fetch.py || python passive_recon_fetch.py

{

You now treat a footprint as a published fact on a name you are allowed to study — example.com or a domain you own — and you treat dorks, Shodan hunts, and neighbor scraping as out of this course. Passive recon is the quiet map. Notes are locked in cyberlium-lab. This is original Cyberlium material covering the same domain as CEH v13 Module 2, not official training and not an exam dump. Next — Active Recon: Touching a Target You Own — names the moment a packet you sent becomes a probe, and why that moment needs writing.