type: attack-pattern
spec_version: 2.1
id: attack-pattern--55fc4df0-b42c-479a-b860-7a6761bcaad0
created: 2020-10-02T16:56:05.810Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1596
external_id: T1596
source_name: Circl Passive DNS
description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.
url: https://www.circl.lu/services/passive-dns/
source_name: DNS Dumpster
description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
url: https://dnsdumpster.com/
source_name: Medium SSL Cert
description: Jain, M. (2019, September 16). Export & Download — SSL Certificate from Server (Site URL). Retrieved October 20, 2020.
url: https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2
source_name: WHOIS
description: NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.
url: https://who.is/
source_name: Shodan
description: Shodan. (n.d.). Shodan. Retrieved October 20, 2020.
url: https://shodan.io
source_name: SSLShopper Lookup
description: SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.
url: https://www.sslshopper.com/ssl-checker.html
source_name: DigitalShadows CDN
description: Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020.
url: https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:48.734Z
name: Search Open Technical Databases
description: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)

Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: reconnaissance
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_version: 1.0