A city marketing site is in scope, and the tester starts with passive archive and certificate transparency review before active crawling. Why is that judgment sound?
Select an answer to reveal the explanation.
Short Explanation
Before you ring the doorbell a thousand times, check the public scrapbook and the certificate bulletin board. Old hostnames and CT entries often show rooms that active crawling has not touched yet. Quieter first, louder later.
Full Explanation
Passive web information gathering uses publicly available sources—archives, certificate transparency logs, public DNS—to map current and historical assets with minimal direct interaction. That approach can reveal forgotten subdomains or endpoints while reducing early detection noise. For in-scope public sites it is a standard professional starting pattern, not an illegal step, and it belongs before—not after—exploitation.