🔭

Passive Reconnaissance: OSINT Network Mapping

Medium

Free preview · 2 of 5 steps

Reconnaissance without touching the target

Effective reconnaissance doesn't require sending a single packet to the target. Public internet infrastructure — DNS, BGP routing tables, certificate transparency logs, Shodan's passive scans, and WHOIS data — reveals enormous amounts about an organization's network before any active probing.

Penetration testers use these techniques first. Defenders should monitor what they expose.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step