Is nslookup counts in passive recon?

CIP general
#1

Hi CIP!
I’m doing red team for the first time. I want to know is nslookup counts in passive recon?

  1. for i in cat linux.hosts; do nslookup $i | grep ^Name -A1| awk ‘{print $2}’;echo;done > outputfile
    I want to run this script, should i do that or it will raise any flags?
    I’m doing as i want ips of from my created subdomains list.
2 Likes
#2

If it is in a short amount time, it will definitely be possible to raise a flage.
I would suggest to use search engines / shodan.io or maybe criminlaip.io / certificate databases
that’s more like “passive recon”

1 Like
#3

any alts to automate it ?

#4

maltego and lots of $$ :wink:

#5

But you’re not querying the target’s services directly necessarily with a nslookup.

#6

i am also looking for something similar like maltego but not so expensive

#7

I’d say if you’re just querying public DNS records about a domain, then it’s passive… if you’re brute forcing subdomains etc., then it’s active.

#8

But that’s just my two cents, I’m sure others would disagree, lol

1 Like
#9

i would agree with user36

#10

cant risk it. dont want to beacome the punching bag of seniors

#11

first rule for a healthy workspace: it must be allowed to make failures and learn from them.

#12

sadly it does not applies if there hardcore office politics goin on

#13

then you better cover your as. as i said: if you can split up the request for example via tor and let it run over a longer timeframe, i’d say it’s really hard to identify as active recon or ask different nameservers