Lab 01: Performing Passive Reconnaissance

Overview

This lab focused on gathering information about a target without directly interacting with its systems. Using search engines, public registration data, DNS records, and open-source intelligence (OSINT) tools, I built a picture of an organization’s external footprint and considered how an ethical hacker could use those findings in later stages of an engagement.

Objectives

  • Use advanced search operators to narrow down public information

  • Query WHOIS and DNS records for domain details

  • Collect hosts and email addresses with OSINT tools

  • Profile a real organization using only public sources

  • Connect reconnaissance findings to possible next steps in a penetration test

Tools and Technologies

  • Google search operators (site:, inurl:, related:, link:, info:)

  • who.is (WHOIS lookups)

  • nslookup (MX and NS queries)

  • theHarvester (Bing and DuckDuckGo sources)

  • Maltego (graph-based OSINT)

Lab Writeup

Google Hacking

  • Compared results for several search operators against a public news site

  • Noted how related: can reveal sister companies and partners that may share infrastructure or trust relationships

  • Noted how link: can surface vendor pages and portals that are useful for social engineering

  • Noted how info: can point to cached content that has since changed on the live site

  • Ran targeted searches against a chosen organization, which returned no results, and considered what exposed credentials, logs, or database flaws would have given an attacker

WHOIS and DNS

  • Ran a WHOIS lookup on my own domain and found the most recent record update, which matched my renewal the day before

  • Saw how a privacy service replaces the registrant’s details in public records

  • Queried MX and NS records with nslookup to identify mail and name servers

OSINT Collection

  • Ran theHarvester against example.com and compared sources: Bing returned nothing, while DuckDuckGo returned a host entry

  • Used Maltego to graph the NS records and email addresses for a target domain

  • Ran a Maltego footprint to list the domain’s IP addresses and domain names

Challenge: Profiling an Organization

  • Profiled Amazon from public sources, documenting its domain, headquarters, executive team and their roles, workforce size per location, and business relationships

  • Identified two ways to use those findings in an authorized test: executive names and roles could support a spear phishing scenario, and physical addresses could scope a physical penetration test

Key Findings

  • A useful target profile can be built without sending anything to the target’s systems

  • Different search operators and OSINT sources return very different results, so one empty result doesn’t mean there’s nothing to find

  • WHOIS privacy services limit what registration records reveal, but DNS records remain public

  • Public details about people can be as valuable to an attacker as technical data

Key Skills Learned

  • Writing advanced search queries

  • Reading WHOIS records and querying DNS

  • Collecting OSINT with theHarvester and Maltego

  • Mapping an organization’s external attack surface

  • Turning raw reconnaissance data into realistic attack scenarios

Topics Covered

  • Passive vs. active reconnaissance

  • Footprinting and OSINT

  • Google hacking

  • Domain registration and DNS records

  • Social engineering attack surface

Conclusion

This lab showed how much information an organization exposes publicly and how little effort it takes to collect it. It also showed why reconnaissance comes first in an engagement, since these findings decide where later testing should focus.

Lab File