PassiveReconn 🔍

A lightweight command-line tool for passive reconnaissance on any domain. It gathers WHOIS registration data, DNS records, and HTTP security headers — all without sending a single active probe to the target host.

---

Features

• WHOIS Lookup — Registrar, creation/expiration dates, name servers, and contact emails
• DNS Records — Queries A, MX, NS, and TXT record types
• HTTP Header Fingerprinting — Extracts Server, X-Powered-By, CSP, HSTS, and other security-relevant headers (HTTPS → HTTP fallback)
• JSON Export — Saves full results to recon_<domain>.json for further analysis

---

Requirements

• Python 3.7+
• pip packages listed in requirements.txt

---

Installation

# Clone or download the project
git clone <repo-url>
cd PassiveReconn

# Install dependencies
pip install -r requirements.txt

---

Usage

python recon.py <domain>

Example

python recon.py example.com

Sample Output

[*] Starting passive reconnaissance on example.com

[+] Full results exported to recon_example.com.json

======================================================================
WHOIS Information - example.com
======================================================================
Registrar:       ICANN
Creation Date:   1995-08-14 04:00:00
Expiration Date: 2025-08-13 04:00:00
Name Servers:    a.iana-servers.net, b.iana-servers.net
Emails:          N/A

======================================================================
DNS Records - example.com
======================================================================
A      : 93.184.216.34
MX     : N/A
NS     : a.iana-servers.net, b.iana-servers.net
TXT    : v=spf1 -all

======================================================================
HTTP Headers - example.com
======================================================================
Server                         : ECS (dcb/7EC7)
X-Powered-By                   : N/A
X-Frame-Options                : DENY
Content-Security-Policy        : N/A
Strict-Transport-Security      : max-age=31536000
X-Generator                    : N/A

[*] Reconnaissance complete

---

Output Files

Each run produces a JSON file named recon_<domain>.json in the current directory. Example structure:

{
  "domain": "example.com",
  "timestamp": "2026-04-10T15:00:00.000000",
  "whois": {
    "registrar": "ICANN",
    "creation_date": "1995-08-14 04:00:00",
    "expiration_date": "2025-08-13 04:00:00",
    "name_servers": ["a.iana-servers.net", "b.iana-servers.net"],
    "emails": []
  },
  "dns": {
    "A": ["93.184.216.34"],
    "MX": [],
    "NS": ["a.iana-servers.net", "b.iana-servers.net"],
    "TXT": ["v=spf1 -all"]
  },
  "http_headers": {
    "Server": "ECS (dcb/7EC7)",
    "X-Powered-By": null,
    "X-Frame-Options": "DENY",
    "Content-Security-Policy": null,
    "Strict-Transport-Security": "max-age=31536000",
    "X-Generator": null
  }
}

---

Legal & Ethical Use

Warning

This tool performs passive reconnaissance only (no port scanning, no exploitation). Use it exclusively on domains you own or have explicit written permission to test. Unauthorized reconnaissance may violate local laws and service terms.

---

Project Structure

PassiveReconn/
├── recon.py          # Main script
├── requirements.txt  # Python dependencies
└── README.md         # This file

---

Dependencies

Package	Purpose
python-whois	WHOIS record lookups
dnspython	DNS query resolution
requests	HTTP/HTTPS header fetching

---

License

MIT — free to use, modify, and distribute.