The hosting information about a website can expose a lot of details about the organization, such as the address, responsible employee, etc.
whois tool can be used for fetching this info,
Search engines are some of the best tools to conduct passive information gathering on websites and companies. Here are some of the popular search engines,
Some of the popular search operators of Google Dorks,
-filetype:html #exclude files that are html
It is a internet services company that gathers various information from websites. They also have a paid service.
Search Engine by NetcraftThis is a module based framework for web based information gathering. You can add the modules and perform the searches to keep adding the results to a database. Finally all the information can be displayed in a presentable form.
It is a search engine that crawls devices connected to the internet including but not limited to the world wide web.
Shodan Search EngineSecurity Headers
This is another website for gathering information about a website or a domain's security posture.
Security HeadersSource Code Info
One of the biggest mistakes a firm can make is leave source code open to the general public and leave sensitive credentials such as username, passwords or api tokens in the source code. Its always a good idea to search the popular project management websites such as GitHub, GitLab or SourceForge.
Gitrob or Gitleaks are tools that search through source code for such secrets. It uses regular expressions for searching through the code base,
This website runs a test of the SSL server of a website and compares the results with the current best practices. It will test the server against some of the popular vulnerabilities.
SSL LabsUser Info Gathering
Email Harvesting
Gaining the email addresses of the employees of an organization is one of the first steps towards social engineering attacks. Harvester tool can be used for finding the email address, domain names, sub domains, IPs and URLs.
Hackers usually dump the illgained credentials in less reputable sites such as,
Social media is one of the best places to gather info about an organizations employees, their interests, events, etc.
Twofi scans a user's twitter feed to create personalized password lists,
linkedin2username is a script that can be used to extract info from Linkedin,
