Back to feed
Dev.to
Dev.to
7/25/2026
The original title is "Building a passive security scanner using third-party data sources"

The original title is "Building a passive security scanner using third-party data sources"

Original: Why I Built a Security Scanner That Never Touches the Target

Short summary

The author built a passive-only security scanner that queries third-party data sources (SSL Labs, Shodan, Censys, Certificate Transparency logs, CIRCL CVE API) instead of sending packets to the target. This avoids legal liability from unauthorized scanning while still providing useful security posture data including certificate validity, exposed services, forgotten subdomains, and known vulnerabilities.

  • •Passive scanning uses cached third-party data to avoid legal issues
  • •Four data sources cover certificates, open ports, subdomains, and CVEs
  • •Trade-off is less depth than active scanning but no legal risk

Generated with AI, which can make mistakes.

#ai-tools
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Passive Reconnaissance on google.com — What I Found Using Shodan, WHOIS, and DNS Tools
Dev.to
The original title is "Writing Code to Watch the Watchers: Log Aggression and Digital Self-Defense"
Dev.to
I Built An API Security Scanner That Won't Shoot You in the Foot
Dev.to
I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it
Dev.to