Passive recon
Map a target from public records without sending it a single packet.
Passive recon answers what exists before you ever interact with the target. Certificate-transparency logs publish every TLS certificate, which reveals subdomains. DNS records reveal mail servers, nameservers, and even security posture through SPF and DMARC text records. None of this touches the target: you are reading public ledgers, not knocking on doors.
Certificate transparency
Every public certificate authority must log each certificate it issues to append-only CT logs (run by Google, Cloudflare, DigiCert, and others). Querying them for %.shop.test returns every subdomain with a certificate: www, api, admin, staging, mail. Tools like crt.sh do exactly what the lab's ct-fetch simulates.
CT is free, legal, and unauthenticated — which is why attackers use it first and why defenders must assume their subdomains are public. If admin.shop.test has a certificate, it is discoverable whether or not it is linked anywhere.
DNS as a public record
DNS answers questions the target cannot refuse: A records give addresses, MX records name the mail handlers (often a third-party provider — a phishing consideration), and TXT records publish SPF (v=spf1 ...) and DMARC policies that state how strictly the domain authenticates its own mail. A missing DMARC record is itself a finding you will learn to report in the library tracks.
Use dig/nslookup patterns in real work; the lab's dns command simulates the answers. Note the query goes to a resolver, never to the target — still passive.
Knowing what each source cannot see
The discipline is knowing what each source cannot see. CT logs miss hosts without certificates (internal tools, staging without TLS). DNS misses internal-only names and anything behind split-horizon views. WHOIS and BGP data age. Say what is missing when it is missing, the same way you will in reports: a footprint with stated gaps beats a confident fiction, and triagers trust testers who mark their blind spots.
In this lab
You footprint a fictional shop, shop.test, using only its scope file, CT logs, and DNS. Read scope.txt first — scope always comes before technique — then pull the CT footprint and answer the flag from the case files. Everything you need is in the terminal.
Key takeaways
- CT logs reveal subdomains; DNS reveals mail, hosting, and mail-auth posture — all passively.
- Every source has blind spots. Record them explicitly.
- Passive findings feed the active phase: unknown hosts become probe targets in the next lesson.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.