Passive Reconnaissance

“If you know the enemy and know yourself, your victory will not stand in doubt.”
- Art of War, Sun Tzu taught. Threat Intelligence is the key for Blue Team while Reconnaissance is the key for the success of the Red Team.

Tools for getting the publicly available information of the Target. This will not trigger/alert the target.
Common tools:
- whois
- nslookup

#whois: Most of the Unix/Linux will have the whois client by default. whois search will give you information about the registrar, nameservers etc. 

commmand: whois <domainname>

#nslookup
command: nslookup -type=<> <domainname> 1.1.1.1

Type
a or A - ipv4
aaaa or AAAA -ipv6
mx or MX for mailserver
txt or TXT for txt file 

server
1.1.1.1 - cloudflare
8.8.8.8 - google
​