Passive first: what you can learn without touching the target
A short case for starting every engagement from the outside, quietly.
There’s a reflex, when you start looking at a target, to reach for the scanner. Resist it for a day. Almost everything that matters early on is already sitting in public data, and none of it sends a packet the other side can see.
The passive surface
A few sources that consistently pay off before you ever make a request to the target’s own infrastructure:
- Certificate transparency. Every cert issued is logged forever. CT logs are a time machine for a company’s subdomain history — including the staging and admin hosts somebody forgot existed.
- Passive DNS. Resolutions other people already observed. You get infrastructure relationships without querying the target’s resolvers.
- Historical records. What an IP or domain pointed to last year often tells you more than what it points to today.
Why it’s worth the discipline
You can’t be rate-limited, blocked, or logged for data you pulled from a third party that was watching anyway.
Passive recon also forces you to build a model of the target before you poke it. By the time you do go active, you’re confirming a hypothesis instead of flailing. That’s the whole idea behind the recon engine inside PHANTOM — treat reconnaissance as inference over public history, not a port sweep.
The loud tools still have their place. Just not on the first pass.