Project: Passive Reconnaissance Toolkit

Build recon.py <domain> that gathers a domain's public footprint into a tidy report:

• WHOIS — registrar, creation/expiry dates, name servers.
• DNS records — A/AAAA, MX, NS, TXT (Lesson 5).
• HTTP fingerprint — public response headers (server, technologies).
• A defender's summary — what this footprint exposes and how to reduce it.

PASSIVE (this lesson)            ACTIVE (later, with authorization)
reads public records only        sends packets TO the target
WHOIS, DNS, search engines       port scans, vuln probes, login attempts
no contact with target systems   directly interacts with the target
low/no legal risk for public data needs explicit written permission

WHOIS — who registered the domain

import whois        # pip install python-whois

def get_whois(domain: str) -> dict:
    try:
        w = whois.whois(domain)
        return {
            "registrar": w.registrar,
            "created": str(w.creation_date),
            "expires": str(w.expiration_date),
            "name_servers": w.name_servers,
            "org": w.org,
        }
    except Exception as e:
        return {"error": str(e)}

WHOIS is a public database of domain registrations. It reveals the registrar, key dates (a soon-to-expire domain is a risk), and sometimes the organisation. Note: many registrars now redact personal contact info under privacy laws — a good thing.

DNS records (from Lesson 5)

import dns.resolver       # pip install dnspython

def get_dns(domain: str) -> dict:
    records = {}
    for rtype in ("A", "AAAA", "MX", "NS", "TXT"):
        try:
            records[rtype] = [str(r) for r in dns.resolver.resolve(domain, rtype)]
        except Exception:
            records[rtype] = []
    return records

HTTP fingerprint — public headers only

import requests

def get_http_fingerprint(domain: str) -> dict:
    try:
        # a single normal GET — what any browser sends; reads public headers
        r = requests.get(f"https://{domain}", timeout=10,
                         headers={"User-Agent": "recon-audit/1.0"})
        interesting = {k: v for k, v in r.headers.items()
                       if k.lower() in ("server", "x-powered-by",
                                        "via", "x-frame-options",
                                        "strict-transport-security",
                                        "content-security-policy")}
        return {"status": r.status_code, "headers": interesting}
    except requests.RequestException as e:
        return {"error": str(e)}

A single normal request reveals the response headers any visitor sees: the Server header may name the web server, X-Powered-By the framework — and crucially, whether security headers (HSTS, CSP, X-Frame-Options) are present. Missing security headers are a finding you can act on defensively.

Wire the gatherers into one tool that profiles a domain and adds a defender's summary — pulling in your Level 7 reporting skills (JSON output, logging).

import argparse, json, logging
from datetime import datetime

logging.basicConfig(level=logging.INFO, format="%(levelname)s %(message)s")
log = logging.getLogger("recon")

def analyse_exposure(dns_records: dict, http: dict) -> list[str]:
    """Turn raw findings into defensive observations."""
    notes = []
    if dns_records.get("MX"):
        notes.append("MX records reveal your email provider — phishers "
                     "will spoof its login page.")
    if len(dns_records.get("TXT", [])) > 3:
        notes.append("Many TXT records — prune stale verification tokens "
                     "that leak which SaaS tools you use.")
    headers = http.get("headers", {})
    if "strict-transport-security" not in {k.lower() for k in headers}:
        notes.append("No HSTS header — add Strict-Transport-Security.")
    if "content-security-policy" not in {k.lower() for k in headers}:
        notes.append("No CSP header — add a Content-Security-Policy (L8-33).")
    if "server" in {k.lower() for k in headers}:
        notes.append("Server header exposes software/version — consider hiding it.")
    return notes

def recon(domain: str) -> dict:
    log.info("passive recon: %s (public records only)", domain)
    report = {
        "domain": domain,
        "scanned_at": datetime.now().isoformat(),
        "whois": get_whois(domain),
        "dns": get_dns(domain),
        "http": get_http_fingerprint(domain),
    }
    report["exposure_notes"] = analyse_exposure(report["dns"], report["http"])
    return report

if __name__ == "__main__":
    p = argparse.ArgumentParser(description="Passive recon (public data only).")
    p.add_argument("domain")
    p.add_argument("--out", default="recon.json")
    a = p.parse_args()

    print("⚠️  Only profile domains you own or are authorised to assess.\n")
    report = recon(a.domain)

    # human summary
    print(f"\n=== {a.domain} ===")
    print("Registrar:", report["whois"].get("registrar"))
    print("A records:", report["dns"].get("A"))
    print("\nDefensive notes:")
    for note in report["exposure_notes"]:
        print("  •", note)

    with open(a.out, "w", encoding="utf-8") as f:
        json.dump(report, f, indent=2, default=str)
    log.info("full report → %s", a.out)

⚠️  Only profile domains you own or are authorised to assess.

INFO passive recon: example.com (public records only)
=== example.com ===
Registrar: RESERVED-Internet Assigned Numbers Authority
A records: ['93.184.216.34']

Defensive notes:
  • No HSTS header — add Strict-Transport-Security.
  • No CSP header — add a Content-Security-Policy (L8-33).
INFO full report → recon.json

Read the result

The toolkit gathers only public data — WHOIS, DNS, and one polite HTTPS request — then the analyse_exposure step is what makes it defensive: it converts raw findings into an action list ("add HSTS," "prune stale TXT," "hide the Server header"). The on-screen warning and the "own or authorised" framing keep it ethical. Run this on your own sites and you'll find real things to fix — which is exactly the point of recon for a defender.

Profile a domain you own (or a clearly-public one like example.com/wikipedia.org for practice).

WANT = ["strict-transport-security", "content-security-policy",
        "x-frame-options", "x-content-type-options"]
present = {k.lower() for k in r.headers}
for h in WANT:
    print(f"  [{'✓' if h in present else ' '}] {h}")

import requests
def cert_subdomains(domain):
    # crt.sh publishes certificate transparency data (public)
    r = requests.get(f"https://crt.sh/?q=%25.{domain}&output=json", timeout=20)
    names = {row["name_value"] for row in r.json()}
    return sorted(n for n in names if "*" not in n)

Passive reconnaissance (OSINT) assembles a target's public footprint — WHOIS, DNS, certificate logs, response headers — without touching its systems, which keeps it low-impact. The defender's use is the best use: run it on yourself to see what attackers see, then shrink it (prune stale DNS, add security headers, hide version strings). The toolkit you built gathers public data, then interprets it into a fix list. The line is firm: passive reading of public data is one thing; probing, scanning, or any use to harass is active/illegal. Recon serves defence — and only against what you own or are authorised to assess.