---
title: "Discussion on \"Network Security: Passive Reconnaissance (TryHackMe)\" | Hashnode"
description: "Discussion on \"Network Security: Passive Reconnaissance (TryHackMe)\". This article will cover the Passive Reconnaissance write-up under the Web Fundamentals on THM.\nIntroduction\nWelcome to the first room of the Network Security Module. This module covers:\n\nPassive Reconnaissance\n\nActive Reconnaissance\n\nNmap Live Host D..."
url: "https://hashnode.com/posts/network-security-passive-reconnaissance-tryhackme/67d73ce517a11e5ce15f1f53"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Network Security: Passive Reconnaissance (TryHackMe)](https://www.sharonjebitok.com/network-security-passive-reconnaissance-tryhackme?utm_source=hashnode&utm_medium=feed)

This article will cover the Passive Reconnaissance write-up under the Web Fundamentals on THM. Introduction Welcome to the first room of the Network Security Module. This module covers: Passive Reconnaissance Active Reconnaissance Nmap Live Host D...

Mar 16, 2025 · 14 min read · sharonjebitok.com  
Read the article

-   [#passive-reconnaissance](https://hashnode.com/tag/passive-reconnaissance)
-   [#network-security](https://hashnode.com/tag/network-security)
-   [#penetration-testing](https://hashnode.com/tag/penetration-testing)
-   [#tryhackme](https://hashnode.com/tag/tryhackme)
-   [#write-up](https://hashnode.com/tag/write-up)

## Written by

[Jebitok](https://hashnode.com/@w1t3r)

@w1t3r · Kenya

  
[View profile](https://hashnode.com/@w1t3r)

Software Developer \* Cyber security Research \* Open for roles

Software Developer | Learning Cybersecurity | Open for roles \* If you're in the early stages of your career in software development (student or still looking for an entry-level role) and in need of mentorship, you can reach out to me.

## Responses 1

Markdown supported · ⌘↵ to post

[kafre02](https://hashnode.com/@kafre02)

[Sep 17](https://hashnode.com/posts/network-security-passive-reconnaissance-tryhackme/67d73ce517a11e5ce15f1f53/comment/6aabe86b949e7d73c9610129)

There's been an update, right at the end of DNSDumpster subsection

"Certificate Transparency (CT) Logs

The most effective passive subdomain discovery method today is Certificate Transparency logs, accessible through crt\[dot\]sh.

Certificate Transparency is a public logging framework (mandatory since approximately 2015) that records every SSL/TLS certificate issued by participating Certificate Authorities. Each certificate contains a Subject Alternative Name (SAN) field listing the domains and subdomains it covers. By searching these logs, you can discover subdomains without sending any traffic to the target.

To use crt\[dot\]sh, visit their site and search for %.\[t\]ryhackme\[.\]com. The % wildcard matches any subdomain. The results will list every certificate issued for subdomains of tryhackme\[dot\]com, often revealing 10 to 100 times more subdomains than DNSDumpster alone.

crt\[dot\]sh is fully passive, operates in real time, and has no rate limits for basic use.

Other passive subdomain discovery options include SecurityTrails (free limited searches) and command-line tools like Subfinder, which aggregate multiple passive sources.

Defender perspective: Organisations monitor CT logs and subdomain lists to catch dangling DNS records (which carry subdomain takeover risk) or unauthorised subdomains."