Passive reconnaissance

Passive recon is a method of collecting information about a target without engaging with the systems actively. We will not directly touch the systems. Instead, we will use indirect methods to gather information about the target, for example, through Shodan and Censys.

Metasploit has a lot of auxiliaries that help in passive recon. In this section, we will look at some of the ways in which we can perform passive recon using Metasploit auxiliaries.

Archived domain URLs

Archived domain URLs are one of the best ways to perform passive recon, as they tell us about the history of the website and its URLs. Sometimes, websites are changed but some old files and folders are left on the server; these may contain...