Footprint a domain from records alone, with provenance

short · 50 min · Objective 2.1

Task

Build an organisation's footprint using only third-party records — touching none of its systems — and record where every fact came from, so each one can be defended later. Passive sources change under you, and a finding you cannot re-demonstrate is one you will lose an argument about.

Steps

  1. Choose the reserved domain example.com as your subject — it exists to be used in examples and belongs to no one you could disturb.
  2. In /tmp/footprint.md, record what registration and DNS records disclose about it, and for each fact write a src: line with the exact query and a ts: line with the timestamp.
  3. Separate fact from inference: a name appearing in a record is a fact; "therefore they own it" is inference, and it is wrong often enough to matter. Mark each line fact: or infer:.
  4. Note which of your sources would be classed passive and which cross into active — reading a cached page is passive, loading it from the origin server is not.
  5. Write the discipline down: any real out-of-scope discovery is reported as existing and never tested.

Verify

grep -cE "^src:\s+\S" /tmp/footprint.md
grep -cE "^ts:\s+\S" /tmp/footprint.md
grep -cE "^(fact|infer):" /tmp/footprint.md

The first two counts must be equal and non-zero: every recorded fact carries its source and its timestamp, because passive sources change and provenance is what lets you re-demonstrate a finding. The third must be non-zero and must include at least one infer: — a footprint with no inferences marked has quietly promoted guesses to facts, which is how a report claims ownership it cannot prove.

Notes

Certificate transparency and job adverts are the highest-yield passive sources on a real engagement — the first finds hosts nobody remembered, the second is an infrastructure inventory the organisation published on purpose. Here you used a reserved domain so the technique is safe to practise; on an engagement the same provenance discipline is what makes the footprint defensible in the report.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.