Footprinting & Reconnaissance
Mission Brief
The CISO at Glasshouse Bank wants to see what an attacker would see BEFORE they touch a single packet on production. Build a passive footprint covering organisation, infrastructure, people, and history — using only public sources.
Story · The bank that thought it was invisible
Glasshouse Bank's CISO opens with: 'We're not on social media, our domain is private-registered, and nobody knows our subdomains. Good luck.'
You smile politely. Within 20 minutes — and zero packets to production — you have: the registrar and contact email, every subdomain ever issued a TLS cert (87 of them), the mail provider from MX + SPF, a forgotten staging portal still indexed by archive.org, three employee LinkedIn profiles naming internal tooling, and a GitHub repo with a .env file from 2022.
This is footprinting. Done well, the noisy phases that follow only ever target assets that actually exist.
Trainer · Core Concepts
The methodical collection of information about a target — domains, IPs, technologies, people, exposed services, historical artefacts — before any disruptive action. CEH treats it as Phase 1 of the ethical-hacking lifecycle and the foundation of the Reconnaissance tactic in MITRE ATT&CK (TA0043).
PASSIVE = no packets sent to target infrastructure. Sources are third-party: RDAP/WHOIS, Certificate Transparency (crt.sh), Shodan/Censys cached data, Wayback Machine, search engines, LinkedIn, GitHub, breach dumps. ACTIVE = packets land on the target: DNS queries to their authoritative NS, port scans, banner grabs, web crawls. Passive is almost always in scope; active needs explicit RoE approval.
1) Organisational (people, structure, partners) · 2) Network (IP ranges, ASN, routing) · 3) System (OS, services, banners) · 4) DNS (records, zones, mail infra) · 5) Web (technologies, headers, paths, archived versions) · 6) Email (formats, MX, SPF/DKIM/DMARC) · 7) People (roles, contacts, breach exposure).
WHOIS/RDAP for ownership · dig/nslookup + DoH for DNS · crt.sh / Sublist3r / amass for subdomains · theHarvester for emails/hosts · Shodan/Censys for service intel · Wayback Machine for historical content · Maltego for graph correlation · Google dorks (site:, filetype:, inurl:) for content discovery · Hunter.io for email format · HaveIBeenPwned for breach exposure.
Privacy-registered WHOIS · scrub document metadata (exiftool) · disable directory listing · serve a thoughtful robots.txt (not security through obscurity) · monitor CT logs for unauthorised certs · rotate developer secrets and audit GitHub for leaks · employee training on what to publish on LinkedIn.
Knowledge Map · drag to explore
Micro Labs
Lab 19 · Passive vs Active classifier
Tag each recon activity as PASSIVE (no packets to target) or ACTIVE (packets to target).
Lab 20 · Source → Data category
Match each OSINT source to the data category it most reliably yields.
Lab 21 · Pick the right countermeasure
For each leak, pick the single most effective countermeasure.
An attacker enumerates 87 subdomains from crt.sh, several pointing to internal-only staging apps.
A 2021 admin portal still appears in Wayback Machine snapshots.
A developer's GitHub repo contains a 2022 .env with what looks like an old DB password.
Knowledge Check
Challenge · 1-page Glasshouse footprint
Using only passive sources, write a 1-page footprint covering: organisation, infrastructure, mail posture, web history, and people exposure — each bullet tagged [P] passive or [A] active and cited.
CEH v13 Exam Focus
- ·Definition of footprinting and its 7 data categories
- ·Passive vs active boundary — and the trap of AXFR/banner grab
- ·Tools mapped to data types (theHarvester, Sublist3r, Maltego, Shodan, crt.sh)
- ·Google dorks: site:, filetype:, inurl:, intitle:, cache:
- ·Countermeasures: WHOIS privacy, metadata scrubbing, CT monitoring
- ·ONS-DWE-P — Org, Network, System, DNS, Web, Email, People (the 7 categories)
- ·Passive = 'no packets to target'. Memorise the four-word version.
- ·AXFR is ACTIVE — always.
- ⚠Calling DNS zone transfer passive
- ⚠Calling 'curl -I' passive (it hits the target)
- ⚠Forgetting that Shodan ITSELF is passive for you, even though Shodan actively scanned earlier
- ⚠Confusing CT logs with DNS — CT lists certs ever issued, not currently live hosts
- ▸WHOIS/RDAP → ownership
- ▸crt.sh → subdomains
- ▸Wayback → history
- ▸Shodan → banners
- ▸theHarvester → emails+subs+hosts
- ▸Maltego → graph correlation