What problem does it solve? During authorized security assessments, testers need to map a target's attack surface without sending any traffic to the target itself. This Skill gathers subdomains, technology fingerprints, and historical endpoints entirely from third-party public sources, leaving zero trace on the target infrastructure. ## Core Features & Use Cases - Subdomain Enumeration: Query crt.sh certificate transparency logs and SecurityTrails to discover subdomains, then filter for high-value assets like admin panels, APIs, and cloud storage. - Technology Fingerprinting: Compute favicon MurmurHash values and match them against known fingerprints (e.g., Tomcat, Spring Boot) to identify tech stacks even when server headers are masked. - Historical URL Mining: Pull Wayback Machine snapshots to recover old JavaScript files, API paths, and sensitive endpoints that may still be reachable. - Use Case: Before testing an authorized bug bounty target, run passive recon to build a list of subdomains, historical API endpoints, and IP intelligence from Shodan, then feed these results into the active recon phase. ## Quick Start Perform passive reconnaissance on the authorized target example.com and collect subdomains, Wayback URLs, and favicon fingerprints without contacting the target.
