🔍 Subdomain Harvesting & Passive Sweep (2024)
In 2024, reconnaissance is focused on passive asset gathering. The objective is to sweep public intelligence data without sending direct request packets to the target’s web servers.
🌐 Subdomain Gathering
We query public search databases using Subfinder and OWASP Amass:
# Subfinder harvests subdomains passively
subfinder -d target.com -o passive_subdomains.txt
# Amass passive scanning
amass enum -passive -d target.com -o amass_passive.txt
📜 Certificate Transparency Logs
Every SSL/TLS certificate issued is logged. Checking these logs can reveal newly registered subdomains:
# Query crt.sh database for wildcards
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > cert_subdomains.txt
🎯 Live Service Mapping
Once the list is gathered, we sweep for open TCP ports using Naabu:
# Naabu fast port scanning
naabu -list passive_subdomains.txt -p 80,443,8080,8443 -o open_ports.txt