Domain & DNS Reconnaissance

Discover unlinked subdomains, historical WHOIS records, Certificate Transparency logs, and reverse IP lookups.

// prerequisite reading

OSINT Basics

What is Domain Reconnaissance?

Domain reconnaissance gathers technical intelligence about an organization’s internet-facing infrastructure. In CTFs and bug bounty hunting, hidden staging servers, development subdomains, or legacy portals (dev.target.com, admin-test.target.com) frequently contain vulnerabilities or hidden flags.

1. Passive Subdomain Enumeration

Passive enumeration discovers subdomains without directly probing the target’s servers, avoiding alert generation.

Certificate Transparency (CT) Logs (`crt.sh`)

Every TLS/SSL certificate issued by a public Certificate Authority is published to public append-only Certificate Transparency logs.

Query crt.sh using curl and jq:

curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

Amass (OWASP)

# Passive subdomain enumeration aggregating over 50 public APIs
amass enum -passive -d target.com -o subdomains.txt

2. Active DNS Reconnaissance

Active enumeration queries target DNS servers directly to test for zone transfers and brute-force common subdomain names.

DNS Zone Transfer Check (`dig`)

If a DNS server is misconfigured to allow unrestricted zone transfers (AXFR), you can dump the entire DNS table instantly:

# 1. Identify authoritative name servers
dig NS target.com +short

# 2. Attempt zone transfer against name server
dig AXFR target.com @ns1.target.com

Subdomain Brute-Forcing with `gobuster`

gobuster dns -d target.com -w /usr/share/wordlists/discovery/dns/subdomains-top1000.txt

3. Historical WHOIS & Passive DNS

When targets update privacy protection or change hosting providers, historical databases expose past owner details, personal email addresses, and registrar info.

SecurityTrails (securitytrails.com): Historical DNS records (A, NS, MX).
Whoxy (whoxy.com): Historical WHOIS ownership records and reverse WHOIS search by owner email address.
Wayback Machine (web.archive.org): View cached snapshots of target websites to discover retired subdomains, old staff directories, and exposed comment sections.