October 28, 2026

TryHackMe: Passive Reconnaissance — Walkthrough & Answers

Task 1. Introduction

By Reubenshaji

2 min read

Task 1. Introduction

Passive reconnaissance involves gathering information about a target using publicly available sources without directly interacting with the target's systems.

In this room, I explored WHOIS, DNS lookups, subdomain discovery, and Shodan to understand how publicly available information can reveal details about an organisation's infrastructure.

Task 2. Passive Versus Active Recon

Passive reconnaissance: Gathering information from public sources without directly engaging with the target.

Active reconnaissance: Directly interacting with a target, such as pinging its server or scanning its ports.

Questions & Answers

Q1. You visit the Facebook page of the target company, hoping to get some of their employee names. What kind of reconnaissance activity is this? (A for active, P for passive)

Answer: P

Q2. You ping the company's web server to check whether ICMP traffic is blocked. What type of reconnaissance is this? (A for active, P for passive)

Answer: A

Q3. You meet the target company's IT administrator at a party and use social engineering to obtain information. What type of reconnaissance is this? (A for active, P for passive)

Answer: A

Task 3. Whois

WHOIS provides information about domain registration, including the registrar, registration dates, domain status, and name servers.

Command

whois tryhackme.com

An alternative is RDAP, which provides structured registration data in JSON format.

curl -s https://rdap.verisign.com/com/v1/domain/tryhackme.com | jq .

Questions & Answers

Q1. When was TryHackMe.com registered?

Answer: 20180705

Q2. What is the registrar of TryHackMe.com?

Answer: namecheap.com

Q3. Which company is TryHackMe.com using for name servers?

Answer: cloudflare.com

Task 4. nslookup and dig

DNS lookups can reveal IP addresses, mail servers, aliases, and text records associated with a domain.

Common DNS record types include:

  • A: IPv4 address
  • AAAA: IPv6 address
  • CNAME: Domain alias
  • MX: Mail servers
  • SOA: Start of Authority information
  • TXT: Text records, often used for SPF, DKIM, DMARC, and domain verification

Commands

Query A records using nslookup:

nslookup -type=A tryhackme.com 1.1.1.1

Query MX records:

nslookup -type=MX tryhackme.com

Query MX records using dig:

dig @1.1.1.1 tryhackme.com MX

Query TXT records:

dig tryhackme.com TXT

dig is generally preferred because it provides detailed DNS information and is useful for troubleshooting and scripting.

Question & Answer

Q1. Check the TXT records of thmlabs.com. What is the flag?

Answer: THM{a5b83929888ed36acb0272971e438d78}

Task 5. DNSDumpster

Subdomains can expose additional services, applications, and potential attack surfaces.

DNSDumpster

DNSDumpster gathers and presents publicly available DNS information, including subdomains, host information, and DNS records.

Question: Look up tryhackme.com on DNSDumpster. Under Services / Banners, which service has the highest count?

Answer: cloudflare

Certificate Transparency — crt.sh

Certificate Transparency logs provide information about issued SSL/TLS certificates. Searching these logs can reveal subdomains listed in certificate records.

Search for:

%.tryhackme.com

Website: https://crt.sh

Question & Answer

Q1. Lookup tryhackme.com on DNSDumpster. Under Services / Banners, which one has the highest count?

Answer: cloudflare

Task 6. Shodan.io

Shodan is a search engine for internet-connected devices. It indexes information about exposed services, ports, and service banners.

Example search filters:

hostname:tryhackme.com
org:"TryHackMe"
port:443 country:US
http.component:"wordpress"

Questions & Answers

Q1. According to Shodan, which country has the highest number of publicly accessible Apache servers?

Answer: United States

Q2. What is the third most common port used for Apache?

Answer: 8080

Q3. What is the most common port used for nginx?

Answer: 80

Task 7. Summary

WHOIS — Domain Registration

whois tryhackme.com

DNS Queries

Query A records (IP addresses):

nslookup -type=A tryhackme.com

Query MX records (mail servers):

nslookup -type=MX tryhackme.com 1.1.1.1

Query TXT records:

nslookup -type=TXT tryhackme.com

DNS Queries Using dig

Query A records:

dig tryhackme.com A

Query MX records using a specific DNS resolver:

dig @1.1.1.1 tryhackme.com MX

Query TXT records:

dig tryhackme.com TXT

Subdomain Discovery

Search for subdomains using Certificate Transparency logs:

Website: https://crt.sh

Search query:

%.tryhackme.com
  • WHOIS and RDAP help identify domain registration details.
  • DNS queries reveal domain records, IP addresses, and mail infrastructure.
  • DNSDumpster and Certificate Transparency logs help discover subdomains.
  • Shodan provides indexed information about internet-facing devices and services.
  • Passive reconnaissance helps identify an organisation's public exposure without directly probing its systems.

Disclaimer: This write-up documents learning from a TryHackMe training room. All techniques should be used only for authorised security research and within the applicable scope. Check the room's current rules before publishing answers and walkthrough details.