Before we start, let’s look at the definition of the work Passive Reconnaissance. Passive reconnaissance is when the person doesn’t interfere or interact with any service or network of the target company. This means the person collects and gathers information that has already been made public, whether with the company’s permission or not.

So when doing passive reconnaissance, you will look around the internet for possible bits and pieces of information you can gather about the target company. So to do that, here are the top 6 tools to get started

1. Hunter.io — For Emails

Hunter.io is an amazing platform that provides the person with the email addresses of a target company that is exposed to the internet.

It also shows you the percentage of that email to be authentic.

2. ViolanOrbert.com — For Emails

This tool is similar to Hunter.io. However, people performing passive recon often like to use multiple tools. This helps them break the limits and gather as much information as they can about their target.

3. Crt.sh — For Subdomains

Crt.sh is one of the popular tools used to find subdomains of a certain website. This helps people determine if there are any services used or information exposed when hiding from the main website. For example, an application or service that shouldn’t be exposed to the internet like webmail.tesla.com (don’t worry, it doesn’t exist)

4. Sublist3r — For Subdomains

This is one of the most used and free tools that quickly find subdomains on the target website. It’s the same as crt.sh but this one is CLI-based. This means you can just install it on your Kali machine with this:

sudo apt install sublist3r

Here is how it looks

5. Wappanalyzer — for finding technologies a website is running on

This tool is essential to find the technologies the website is running on. Its fasted and presents information as a Chrome extension.

There are similar tools like whatweb and buildwith.com both do the same. But each of them is used to gather as much information that other tools couldn’t find.

6. Burpsuite — For a lot of things

Burpsuite provides a lot more information related to the technology a website is running and what services it’s running. It also lets you capture information and alter it to gather as much information as you want.

There are many other tools like Owasp Amass that is used by a lot of bug bounty hunters to find subdomains and a lot more. With time new tools will emerge allowing people to gather as much information as they can. So keep an eye out for the latest tools that can help you save time and gather as much info as you want.

Hope you have a great day.