Passive Domain Recon

The problem

Mapping a target's attack surface usually requires heavy third-party tools or aggressive active scanning that triggers alarms. Developers often need a quiet, dependency-free way to inventory subdomains and certificates without installing external binaries or Python packages.

What it does

• Enumerate subdomains using DNS resolution and Certificate Transparency logs via crt.sh.
• Extract SSL certificate metadata including expiry dates and Subject Alternative Names (SAN).
• Perform recursive WHOIS lookups by following IANA referrals to registrar servers.
• Analyze HTTP response headers using benign HEAD requests to identify server stacks and security headers.
• Generates a greppable CSV report of the findings for further pipeline processing.

Frameworks & tools

Python Standard Library (socket, ssl, urllib, json). No pip installs required.

Why this beats prompting it yourself

Writing reliable network code in Python requires specific error handling for DNS timeouts, TLS handshake failures, and WHOIS socket management. This skill provides a hardened, rate-limited workflow that avoids the common pitfalls of LLM-generated networking scripts like missing rate limits or improper socket closing.

Use cases

• Perform initial reconnaissance on a new project domain before a security audit.
• Inventory all subdomains and their SSL certificate statuses for compliance.
• Identify tech stacks and version disclosure via passive header analysis.
• Monitor for certificate expiration across a distributed infrastructure.

Known limitations

Restricted to passive data sources. Does not perform port scanning, directory brute-forcing, or vulnerability testing. Requires internet access for crt.sh and WHOIS servers.