The CROX Sec Method: complete passive external security audit (definitive guide)

# The CROX Sec Method: complete passive external security audit

The definitive Spanish-speaking world's guide to auditing any domain's security surface WITHOUT touching it: zero intrusive packets, zero authorization needed, zero excuses. Everything below runs from a terminal and one afternoon of your time.

---

PHILOSOPHY: see what the attacker sees

Your internal firewall, policies and antivirus are invisible to your attacker: he only sees what's public. Passive auditing replicates that view. If you find doors from outside, an attacker would find them. Close those doors and 90% of opportunistic attacks bounce off.

PHASE 1 — Subdomain map (20 minutes)

Every TLS certificate is publicly logged in Certificate Transparency logs. It's the most honest map in existence:

curl -s "https://crt.sh/?q=%25.DOMAIN&output=json" | jq -r '.[].name_value' | sort -u > subs.txt

Clean wildcards and duplicates. What's left is EVERYTHING that ever had HTTPS — including what the team forgot.

Defense: turn off DNS for what no longer exists. A subdomain that doesn't resolve can't be hijacked.

PHASE 2 — What responds, and with what (15 minutes)

cat subs.txt | httpx -title -tech-detect -status-code -silent 2>/dev/null > alive.txt

Or manually for few domains. Flag: login panels (403/401/200 with form), known services (webmail, phpmyadmin, jenkins, grafana), third-party subdomains (CNAME to SaaS).

PHASE 3 — Header X-ray (10 minutes per live domain)

curl -sI https://DOMAIN | grep -iE 'strict-transport|content-security|x-frame|x-content|referrer|server|x-powered'

Quick table:

**No HSTS** → downgrade possible on hostile networks

**No CSP/X-Frame** → clickjacking and resource injection

**Server/X-Powered with version** → fingerprinting gift

**No security.txt** → the honest researcher has no way to reach you

PHASE 4 — Mail DNS: impersonation (15 minutes)

dig +short TXT DOMAIN | grep -i spf

dig +short TXT _dmarc.DOMAIN

dig +short TXT default._domainkey.DOMAIN

**SPF missing or +all** → anyone sends as you

**DMARC missing or p=none** → brand phishing runs free

**DKIM missing** → spoofs go undetected

The complete fix (SPF + DKIM + DMARC p=quarantine→reject) kills corporate phishing and takes one afternoon.

PHASE 5 — Typical exposures (30 minutes)

Paths that almost always reveal something:

for p in .git/config .env backup.zip backup.sql .well-known/security.txt xmlrpc.php wp-json wp-login.php phpmyadmin adminer.php; do

  code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 6 https://DOMAIN/$p)

  [ "$code" = "200" ] && echo "EXPOSED! /$p"

done

PHASE 6 — TLS and cryptography (15 minutes)

echo | openssl s_client -connect DOMAIN:443 -servername DOMAIN 2>/dev/null | openssl x509 -noout -dates -issuer

nmap --script ssl-enum-ciphers -p 443 DOMAIN

Full chain, dates, old protocols alive (TLS1.0/1.1 = problem), weak ciphers.

PHASE 7 — The report that executes itself

Every finding is logged with: severity, evidence (command + output), concrete fix, fix-verification command. No theory: the list turns into tickets directly.

FREQUENCY: watch, don't audit once

Passive recon fits in a weekly cron. What changes week to week is what matters: a new subdomain, a strange certificate, a modified DNS record. That's a signal of life — legitimate or not.

---

*CROX Sec publishes open security research. If this was useful: BTC `bc1qfulwc94ej036rauexs3aa76td0xpquhzld96lx` · XNO `nano_38ddjn4jd1pkgp6ugaoyyeqtkbaes7oby11m1u8asfr7bwg13h5x51uky9r1` · Nostr `npub1grgfze827hsgh8hn2eh3glswg7fyyun3yrjx3uchqszguwwxufuq8uazte`*