Passive reconnaissance: subdomain enumeration via crt.sh/DNS history, Shodan/Censys IP intelligence, favicon hash matching for tech stack, Wayback Machine URL history, WHOIS data. All free, no target contact.
Passive reconnaissance: subdomain enumeration via crt.sh/DNS history, Shodan/Censys IP intelligence, favicon hash matching for tech stack, Wayback Machine URL history, WHOIS data. All free, no target contact.