passive-recon

Document passive OSINT asset discovery using FOFA, Quake, and Hunter query syntax.

1.6k|234|Updated Dec 7, 2019

Search Tags:#osint #asset-discovery #fofa #hunter #passive-recon #quake

Ready to run

npx skills add https://github.com/wgpsec/AboutSecurity --skill passive-recon

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: passive-recon
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/recon/passive-recon
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill passive-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Pure passive OSINT gathering provides asset exposure information without touching the target, helping teams perform pre-engagement research and cross-engine asset discovery while staying stealthy.

Core Features & Use Cases

Zero-contact intelligence: identify exposed assets and domain footprints using public engines.
Cross-engine correlation: consolidate results from multiple sources (FOFA, Quake, Hunter) for a complete asset view.
Reference-backed validation: consult search-engine syntax and reference materials to verify findings.

Quick Start

Run a passive search across FOFA, Quake, and Hunter to collect assets and cross-check results with references.

Frequently Asked Questions about passive-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I gather OSINT assets without contacting the target?▼

Passive recon maps exposed assets and domain footprints using public search engines without touching the target, enabling stealthy pre-engagement research and red-teaming reconnaissance while maintaining zero contact with the target infrastructure.

Can I use FOFA, Quake, and Hunter together for asset discovery?▼

Cross-engine asset discovery consolidates results from FOFA, Quake, and Hunter to provide a complete asset view. This correlation across multiple public search engines ensures comprehensive exposure mapping without directly contacting the target.

What is passive reconnaissance in red-teaming?▼

Passive reconnaissance in red-teaming is the pre-engagement research phase where you map target assets using public engines. It identifies exposed assets and domain footprints stealthily, avoiding direct interaction with the target's network.

How do I validate findings from search engine syntax queries?▼

You validate findings by consulting search-engine syntax references and reference materials. The Skill provides engine-specific query syntax guidance for FOFA, Quake, and Hunter to help verify and cross-check collected assets.

What are the limitations of passive recon compared to active scanning?▼

Passive recon relies solely on public search engine indexes, meaning it cannot find assets unknown to engines like FOFA, Quake, or Hunter. It also lacks real-time validation, requiring reference-backed cross-checking to verify historical exposure findings.