• The CROX Sec Method: complete passive external security audit
  • PHILOSOPHY: see what the attacker sees
  • PHASE 1 — Subdomain map (20 minutes)
  • PHASE 2 — What responds, and with what (15 minutes)
  • PHASE 3 — Header X-ray (10 minutes per live domain)
  • PHASE 4 — Mail DNS: impersonation (15 minutes)
  • PHASE 5 — Typical exposures (30 minutes)
  • PHASE 6 — TLS and cryptography (15 minutes)
  • PHASE 7 — The report that executes itself
  • FREQUENCY: watch, don’t audit once

§The CROX Sec Method: complete passive external security audit

The definitive Spanish-speaking world’s guide to auditing any domain’s security surface WITHOUT touching it: zero intrusive packets, zero authorization needed, zero excuses. Everything below runs from a terminal and one afternoon of your time.

§PHILOSOPHY: see what the attacker sees

Your internal firewall, policies and antivirus are invisible to your attacker: he only sees what’s public. Passive auditing replicates that view. If you find doors from outside, an attacker would find them. Close those doors and 90% of opportunistic attacks bounce off.

§PHASE 1 — Subdomain map (20 minutes)

Every TLS certificate is publicly logged in Certificate Transparency logs. It’s the most honest map in existence:

curl -s "https://crt.sh/?q=%25.DOMAIN&output=json" | jq -r '.[].name_value' | sort -u > subs.txt

Clean wildcards and duplicates. What’s left is EVERYTHING that ever had HTTPS — including what the team forgot.

Defense: turn off DNS for what no longer exists. A subdomain that doesn’t resolve can’t be hijacked.

§PHASE 2 — What responds, and with what (15 minutes)

cat subs.txt | httpx -title -tech-detect -status-code -silent 2>/dev/null > alive.txt

Or manually for few domains. Flag: login panels (403/401/200 with form), known services (webmail, phpmyadmin, jenkins, grafana), third-party subdomains (CNAME to SaaS).

§PHASE 3 — Header X-ray (10 minutes per live domain)

curl -sI https://DOMAIN | grep -iE 'strict-transport|content-security|x-frame|x-content|referrer|server|x-powered'

Quick table:

• No HSTS → downgrade possible on hostile networks
• No CSP/X-Frame → clickjacking and resource injection
• Server/X-Powered with version → fingerprinting gift
• No security.txt → the honest researcher has no way to reach you

§PHASE 4 — Mail DNS: impersonation (15 minutes)

dig +short TXT DOMAIN | grep -i spf
dig +short TXT _dmarc.DOMAIN
dig +short TXT default._domainkey.DOMAIN

• SPF missing or +all → anyone sends as you
• DMARC missing or p=none → brand phishing runs free
• DKIM missing → spoofs go undetected

The complete fix (SPF + DKIM + DMARC p=quarantine→reject) kills corporate phishing and takes one afternoon.

§PHASE 5 — Typical exposures (30 minutes)

Paths that almost always reveal something:

for p in .git/config .env backup.zip backup.sql .well-known/security.txt xmlrpc.php wp-json wp-login.php phpmyadmin adminer.php; do
  code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 6 https://DOMAIN/$p)
  [ "$code" = "200" ] && echo "EXPOSED! /$p"
done

§PHASE 6 — TLS and cryptography (15 minutes)

echo | openssl s_client -connect DOMAIN:443 -servername DOMAIN 2>/dev/null | openssl x509 -noout -dates -issuer
nmap --script ssl-enum-ciphers -p 443 DOMAIN

Full chain, dates, old protocols alive (TLS1.0/1.1 = problem), weak ciphers.

§PHASE 7 — The report that executes itself

Every finding is logged with: severity, evidence (command + output), concrete fix, fix-verification command. No theory: the list turns into tickets directly.

§FREQUENCY: watch, don’t audit once

Passive recon fits in a weekly cron. What changes week to week is what matters: a new subdomain, a strange certificate, a modified DNS record. That’s a signal of life — legitimate or not.

CROX Sec publishes open security research. If this was useful: BTC bc1qfulwc94ej036rauexs3aa76td0xpquhzld96lx · XNO nano_38ddjn4jd1pkgp6ugaoyyeqtkbaes7oby11m1u8asfr7bwg13h5x51uky9r1 · Nostr npub1grgfze827hsgh8hn2eh3glswg7fyyun3yrjx3uchqszguwwxufuq8uazte