passive-recon

Document passive OSINT asset discovery using FOFA, Quake, and Hunter query syntax.

1.6k|234|Updated Dec 7, 2019
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill passive-recon
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: passive-recon
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/recon/passive-recon
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill passive-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Pure passive OSINT gathering provides asset exposure information without touching the target, helping teams perform pre-engagement research and cross-engine asset discovery while staying stealthy.

Core Features & Use Cases

  • Zero-contact intelligence: identify exposed assets and domain footprints using public engines.
  • Cross-engine correlation: consolidate results from multiple sources (FOFA, Quake, Hunter) for a complete asset view.
  • Reference-backed validation: consult search-engine syntax and reference materials to verify findings.

Quick Start

Run a passive search across FOFA, Quake, and Hunter to collect assets and cross-check results with references.

Frequently Asked Questions about passive-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather OSINT assets without contacting the target?

Passive recon maps exposed assets and domain footprints using public search engines without touching the target, enabling stealthy pre-engagement research and red-teaming reconnaissance while maintaining zero contact with the target infrastructure.

Can I use FOFA, Quake, and Hunter together for asset discovery?

Cross-engine asset discovery consolidates results from FOFA, Quake, and Hunter to provide a complete asset view. This correlation across multiple public search engines ensures comprehensive exposure mapping without directly contacting the target.

What is passive reconnaissance in red-teaming?

Passive reconnaissance in red-teaming is the pre-engagement research phase where you map target assets using public engines. It identifies exposed assets and domain footprints stealthily, avoiding direct interaction with the target's network.

How do I validate findings from search engine syntax queries?

You validate findings by consulting search-engine syntax references and reference materials. The Skill provides engine-specific query syntax guidance for FOFA, Quake, and Hunter to help verify and cross-check collected assets.

What are the limitations of passive recon compared to active scanning?

Passive recon relies solely on public search engine indexes, meaning it cannot find assets unknown to engines like FOFA, Quake, or Hunter. It also lacks real-time validation, requiring reference-backed cross-checking to verify historical exposure findings.