OSINT & Recon Tools Cheat Sheet: Passive Footprinting
Reconnaissance is step one of every engagement and every kill chain: map what a target exposes before you touch it. This is the passive side — DNS, WHOIS, certificates, public search — the commands and free tools that build a picture without sending a single packet at the target itself. Then take what you find to the Nmap cheat sheet for the active phase.
Authorized use only. Reading public DNS, certificate and WHOIS data is passive and generally fine. Actively enumerating, scanning, or screenshotting hosts you don't own or aren't authorized to test can cross a legal line. Only point these at your own assets, or a target with a signed scope.
Passive first, active later
Passive recon reads data that's already public — the target never sees you looking. Active recon (port scans, directory brute-forcing, screenshotting live hosts) sends traffic and leaves logs. Do the passive work here first: it's quiet, it's legal on public records, and it tells you where to point the noisier tools.
Map DNS and ownership from the shell
No account, no tool to install — whois and dig ship on most systems.
whois example.com
Registrar, registrant (when not privacy-masked), creation and expiry dates, and nameservers. Your first look at who owns a domain.
dig +short example.com
The A records — the IPs a name points to. Drop +short for the full answer with TTLs.
dig example.com MX
Mail servers. Swap MX for TXT to read SPF, DKIM and domain-verification records — which often name the SaaS a company uses.
dig +short -x 1.1.1.1
Reverse lookup: turn an IP back into a hostname. Useful for naming the boxes behind the addresses you found above.
Find subdomains with Certificate Transparency
Every public TLS certificate is logged. Because certs name the hosts they cover, those logs are a goldmine of subdomains — no brute force, no traffic to the target. Query crt.sh in the browser, or pull it clean from the shell:
curl -s 'https://crt.sh/?q=%.example.com&output=json' | jq -r '.[].name_value' | sort -u
Pulls every logged certificate name for the domain and its subdomains, then dedupes. Needs jq. The % is a SQL wildcard, so this catches *.example.com too.
Trace a username across the web
One handle usually reuses across dozens of sites. Maigret checks a username against hundreds of public sites and builds a report — handy for authorized self-assessment, brand monitoring and incident-response enrichment. Treat every hit as a lead to verify, never proof of identity.
maigret johndoe
Runs the handle against Maigret’s site list and writes a report. Add --html for a browsable result. Point it at a username you own first.
Web recon and intel tools
When you'd rather point-and-click, or need to pivot across an org's whole footprint. All free to use (some gate heavier features behind an account).
| Tool | What it finds |
|---|---|
| Shodan | Search engine for internet-connected hosts. Find exposed services, banners, and open ports across an organisation's IP space. Has a CLI. |
| crt.sh | Certificate Transparency logs. Every TLS cert an org has issued leaks its subdomains — a fast, passive way to map attack surface. |
| ViewDNS.info | A toolbox in one page: reverse IP lookup, DNS records, WHOIS history, port checks. |
| DNSlytics | Reverse IP, NS and MX lookups plus WHOIS — good for finding what else shares a server or nameserver. |
| host.io | Domain intelligence: backlinks, related domains, redirects, and the tech behind a name. |
| Whoxy | WHOIS lookups with historical records and a reverse-WHOIS API — pivot from a registrant name or email to their other domains. |
| Wappalyzer | Fingerprints the tech stack: CMS, framework, analytics, CDN. Browser extension or lookup. |
| WhatCMS | Detects which CMS (WordPress, Drupal, etc.) and version a site runs. |
| Aquatone | Takes a list of hosts and screenshots them all, so you can eyeball a large attack surface at a glance. |
Fingerprint the stack, then picture it
Before you probe an app, know what it's built on. Wappalyzer reads the framework, CDN and analytics; WhatCMS pins the CMS and version. For a big list of hosts, let aquatone screenshot them all so you can spot the interesting ones by eye:
cat subdomains.txt | aquatone -out ./flyover
Feeds your discovered hosts in, visits each, and writes a browsable report of screenshots and response headers to ./flyover. Turns a wall of hostnames into something you can skim.
Where to go next
- Nmap cheat sheet — the active phase: scan the hosts you just mapped and identify what's running.
- Common ports cheat sheet — make sense of the open ports a scan turns up.
- Hands-on labs — practise the whole chain against legal targets.
- One-Liner-OSINT — a big collection of copy-paste OSINT one-liners to grow the toolkit.
- Trace Labs OSINT VM — a ready-made Linux OSINT workbench with the tools preinstalled.
Commands checked on current bind-tools (dig) and the live crt.sh JSON API on the date shown up top. Tool descriptions reflect each service's free tier. Spot something out of date? Tell me and I'll fix it.