Learning · Information Gathering · Passive Information Gathering
TA
tomrisBlue Team

Overview

12 min readModule 1 · Lesson 3 of 8

Passive information gathering is the technique of collecting information about a target without interacting directly with the target's systems. The goal is to gather as much data as possible from public sources without leaving any trace that the target could detect.

Because there is no direct connection to the target, this technique is very hard to detect — making it the ideal first step in an engagement.

Commonly used sources

  • WHOIS & DNS records — domain ownership and IP addresses
  • Search engine dorking (Google Dorks)
  • Social media & job postings
  • OSINT tools such as Maltego and theHarvester

Example commands

# Collect emails & subdomains from public sources
analyst@kali:~$ theHarvester -d hospital.local -b google
# View domain registration data
analyst@kali:~$ whois hospital.local
Lab Environment — Kali Linux (attacker)CONNECTED
startTerminalFirefox14:32 · Fri