recon

Passive recon: map a stack from subdomains, archived URLs, TXT records, MX, nameservers, and secret scans without sending one packet to the target.

TL;DR: Passive recon maps a domain's tech stack from public data alone—DNS, subdomains, old URLs, headers—without touching the target. The catch: signals mislead easily, since verification tokens don't prove actual usage and Cloudflare headers matter less than nameserver records. Found secrets? Stop at discovery—validation crosses into active territory, so report through official disclosure channels.