A city marketing site is in scope, and the tester starts with passive archive and certificate transparency review before active crawling. Why is that judgment sound?
Select an answer to reveal the explanation.
Short Explanation
Before you ring the doorbell a thousand times, check the public scrapbook and the certificate bulletin board. Old hostnames and CT entries often show rooms that active crawling has not touched yet. Quieter first, louder later.
Full Explanation
Starting a city marketing-site engagement with passive archive and certificate-transparency review before active crawling is sound because passive sources can reveal historical hosts, names, and certificates while reducing early noise. Passive review is not discouraged in professional web recon; maximum-rate active crawling is not the only valid approach. Consulting certificate transparency and archives for in-scope public sites is generally lawful intelligence gathering, not an illegal act by default. Passive techniques add value before exploitation and are not reserved for post-foothold work. Exam caveat: still honor RoE and data-handling rules when historical pages contain sensitive civic data. Operational check: query CT logs and archives for the city's domains, note vanished admin or staging names, then plan measured active crawling that respects rate limits and scope. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.