Checklist

OSINT

• bbot

• TheHarvester

• subfinder

• dns-dumpster

• security trails

• Shodan

• Fofa

• leakX

• C99

• saby (dencel:Xx3837271)

• list org

• bgp tools

• iphistory dnstrails dnshistory whoisrequest

• https://ip.thc.org/

  curl https://ip.thc.org/sb/example.com
  curl https://ip.thc.org/140.82.121.3

DNS RECON

Subdomains enumeration | The Hacker Recipeswww.thehacker.recipes

gobuster dns --domain "target.domain" --resolver "nameserver" --wordlist "/path/to/wordlist"

COLLECT SCREENSHOT

install httpx

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

install chromium

sudo apt install -y chromium

collect screenshots

httpx -l hosts.txt -ss -system-chrome

SCAN

das add masscan '--rate 1000 -iL hosts.txt -p1-65535 --open'

das scan -hosts all -oA report1

ACTIVE

• OWA/ADFS/SKYPE enum → spray

• CMS

• CVE

• Open ports

• Web