Passive Information Gathering
Hosting Information
The hosting information about a website can expose a lot of details about the organization, such as the address, responsible employee, etc.
whois tool can be used for fetching this info,
Search Engines
Search engines are some of the best tools to conduct passive information gathering on websites and companies. Here are some of the popular search engines,
Google Dorks
Some of the popular search operators of Google Dorks,
site:particle42.com
filetype:pdf
-filetype:html #exclude files that are html
intitle:"index of"
Netcraft
It is a internet services company that gathers various information from websites. They also have a paid service.
Recon-ng
This is a module based framework for web based information gathering. You can add the modules and perform the searches to keep adding the results to a database. Finally all the information can be displayed in a presentable form.
Shodan
It is a search engine that crawls devices connected to the internet including but not limited to the world wide web.
Security Headers
This is another website for gathering information about a website or a domain's security posture.
Source Code Info
One of the biggest mistakes a firm can make is leave source code open to the general public and leave sensitive credentials such as username, passwords or api tokens in the source code. Its always a good idea to search the popular project management websites such as GitHub, GitLab or SourceForge.
Gitrob or Gitleaks are tools that search through source code for such secrets. It uses regular expressions for searching through the code base,
SSL Info
SSL Labs
This website runs a test of the SSL server of a website and compares the results with the current best practices. It will test the server against some of the popular vulnerabilities.
User Info Gathering
Email Harvesting
Gaining the email addresses of the employees of an organization is one of the first steps towards social engineering attacks. Harvester tool can be used for finding the email address, domain names, sub domains, IPs and URLs.
Password Dumps
Hackers usually dump the illgained credentials in less reputable sites such as,
Social Media Tools
Social media is one of the best places to gather info about an organizations employees, their interests, events, etc.
Twofi scans a user's twitter feed to create personalized password lists,
linkedin2username is a script that can be used to extract info from Linkedin,
Last updated
Was this helpful?
