Building a Passive Recon Scanner Without Touching the Target

Passive reconnaissance is underrated. Before a single request touches the target, there's a surprising amount of signal available from public sources — CMS fingerprints, exposed metadata, and search engine artifacts. This post walks through the design of a single-file, zero-dependency passive recon tool covering eleven CMS fingerprints and three search providers, and why I optimised for portability over features.