dns

Passive recon: map a stack from subdomains, archived URLs, TXT records, MX, nameservers, and secret scans without sending one packet to the target.

TL;DR: Passive recon maps a domain's tech stack from public data alone—DNS, subdomains, old URLs, headers—without touching the target. The catch: signals mislead easily, since verification tokens don't prove actual usage and Cloudflare headers matter less than nameserver records. Found secrets? Stop at discovery—validation crosses into active territory, so report through official disclosure channels.

A local domain via /etc/hosts plus DOMAIN and ROOT_URL in Forgejo, and the 100 MB Cloudflare upload cap that makes the SSH path the sensible choice.

Months spent blaming an anti-bot; the culprit was an Indonesian ISP's DNS redirecting duckduckgo.com to Trustpositif.

TL;DR: Headless browser tests inside Docker kept failing on DuckDuckGo, and I wasted months blaming anti-bot fingerprinting. The real culprit was Indonesian ISP DNS poisoning; Kominfo's 2015 mandate redirects port 53 queries, so duckduckgo.com resolved to a wrong IP. The fix was one flag: docker run --dns 1.1.1.1 restored access instantly.