In an investigation, you often start with a single piece of information: a domain name, an IP address, or an SSL certificate. This is your thread. Infrastructure pivoting is the process of pulling on that thread to uncover the entire network connected to it. It’s about methodically leaping from one technical artifact to another, mapping out servers, subdomains, and related websites that aren't immediately obvious.

Each piece of data is a potential pivot point. A domain can lead you to an IP address. That IP address might host other domains. An SSL certificate might be used across multiple servers. The goal is to follow these connections to build a complete picture of a target's digital footprint.

This process involves a crucial trade-off. Passive techniques, like analysing historical data, leave no trace and won't alert your target. Active techniques, such as scanning a network block, are more direct but can be detected. Choosing the right approach depends on the investigation's goals and constraints.

The internet has a long memory. Several key sources store historical data that can reveal connections between digital assets long after they've changed. These passive sources are invaluable for uncovering hidden infrastructure without directly interacting with the target.

Passive DNS (pDNS) lets you look back in time. Did example.com use a different IP address two years ago? What other domains have ever been hosted on 192.0.2.100? This historical context can link a target to infrastructure they no longer use but that might still contain valuable information. Since you're just querying a third-party database, your investigation remains completely invisible to the target.

Similar to pDNS, WHOIS history provides a log of past registration details for a domain. While privacy services often hide current registrant information, historical records can be a goldmine. You might find an old email address, name, or organisation that was once tied to the domain. You can then use that information as a new pivot point to search for other domains registered by the same entity.

Beyond historical records, you can pivot using the unique technical characteristics of a server. These 'fingerprints' can link servers together even if they have different IP addresses and domain names.

Certificate Transparency (CT) logs are public databases of all issued SSL/TLS certificates. When a certificate is created for example.com, it's logged. Crucially, certificates often cover multiple domains and subdomains (e.g., www.example.com, api.example.com, dev.example.com). By searching CT logs for a known domain, you can quickly discover a wide range of related subdomains that might not be publicly linked anywhere else.

Technological fingerprinting goes deeper. Every server configuration has subtle traits that can be used for identification.

• Server Banners: When you connect to a service like HTTP or SSH, it often returns a 'banner' with information about the software version. A custom or unusual server banner can be a unique signature to search for across the internet.
• Favicon Hashes: Many websites have a small icon that appears in the browser tab, called a favicon. You can calculate a unique hash (a fixed-size string of characters) from this image file. If two different websites use the exact same favicon, they will have the same hash, suggesting a connection.
• JARM: This is a more advanced technique. A JARM hash is a fingerprint of how a server responds to a series of specific TLS connection requests. Since different TLS libraries and configurations respond in unique ways, the JARM hash can identify servers running the same software stack, even if they're on different IPs.

Finally, there's reverse IP lookup and netblock analysis. A reverse IP lookup shows all the other domains that are hosted on the same IP address. This is especially useful for finding sites on shared hosting environments. Going a step further, you can analyse the entire network block (a range of IP addresses) owned by an organisation to identify other servers they might be using. This is a more active technique, as it often involves scanning the IP range, but it can be highly effective for mapping out a target's entire presence in a specific data centre.

By combining these techniques, an investigator can turn a single piece of information into a comprehensive map of a target's digital world.