OSINT Source Categorizer

Every engagement starts with looking, and the first thing a tester has to know is whether the looking leaves a mark. That is the whole distinction here, and it is narrower than it sounds. The question is not whether the information is about the target, and not whether gathering it is legal, quiet, or clever. The question is only this: did a packet from you reach a machine the target operates? If yes, the activity is Active and it can appear in their logs. If no, it is Passive and there is nothing for them to find. The six Passive items all route around the target. Searching LinkedIn queries LinkedIn's servers. Reviewing job postings queries a job board. WHOIS queries a registrar, which is required to publish the record. Shodan is the one people argue about, and the argument dissolves once you notice who did the scanning: Shodan scanned the internet months ago and stored the result, so searching it reads Shodan's database, not the target's ports. The phrase in the item — without probing it directly — is doing real work, because the moment you take a Shodan result and verify it yourself, you have crossed into Active. Google dorking is the same shape and trips people more often. A dork like site:target.com filetype:pdf feels like it reaches into the target's web server, and the files it finds genuinely live there. But you never touch that server: Google's crawler fetched those files, Google's index stores them, and your query goes to Google. The target's logs show a Googlebot visit that was going to happen anyway. Certificate transparency is the sharpest case and the one worth the most discussion. CT logs are append-only public ledgers that Certificate Authorities are obliged to write to every time they issue a certificate, and anyone can read them. Pulling every certificate ever issued for a domain hands you a subdomain list — including internal-sounding hosts like vpn, staging and mail-admin that were never meant to be advertised — and it does this without a single packet reaching the target. It is maximally revealing and perfectly passive, which is exactly why it is the first thing a good tester runs and exactly why it unsettles students who expect stealth and yield to trade against each other. They do not, always. DNS is where the line genuinely blurs, and the wording of the item is the whole answer. An ordinary DNS lookup resolves through your recursive resolver, which may answer from cache and never contact the target at all — that is why DNS lookups appear on the passive side of most textbook lists. A zone transfer is a different thing wearing similar clothes. It is an AXFR request sent to the target's own authoritative name server, asking it to hand over every record in the zone at once. You are talking to their machine, they can log it, and on a correctly configured server they will refuse. Same protocol, opposite bin. That is the lesson: passive and active are not properties of a technology, they are properties of a specific action, and DNS is the clearest proof. The remaining Active five are less subtle but establish the pattern. An Nmap port scan, a ping, an SMB share enumeration, a Nessus vulnerability scan and a crafted HTTP request to grab a service banner all send traffic to the target and all appear in something — a firewall log, an IDS alert, a web server access log. They vary enormously in loudness. A single ping is one ICMP packet that any noisy network absorbs; a full Nessus scan is thousands of requests, some of which actively try to trigger the vulnerability they are testing for, and it is the least stealthy thing on this list by a wide margin. But loud and quiet is a separate axis from passive and active. All five are Active because all five make contact, and the sorting grades contact, not volume. Two practical consequences follow. First, order of operations: exhaust the passive sources before sending a packet, because everything you learn passively is free and everything you learn actively spends detection risk you cannot get back. Second, scope and authorization: passive reconnaissance against a company you have no agreement with is generally lawful, since you are reading public records, while active reconnaissance without written authorization is where a penetration test becomes an intrusion. The bin an activity lands in is not a technical curiosity — on a real engagement it is the difference between research and a crime.