ASN's(autonomous system numbers) - (ip ranges , keyword searches)

ARIN & RIPE - arin ripe whoislookups all

Rev whois - rev

shodan - shodan

we cannot miss out on burp

domlink domlink

builtwith - they also has a browser plugin it tells about stack that site is bult on and analytics

• google dorks
• robtex
• waybackmachine
• sublist3r
• Amass
• subfinder
• Cloudflare Enumeration Tool

• massdns

  ex: .subbrute.py /root/work/bin/all.txt $TARGET.com | ./bin/massdns -r resolvers.txt -t A -a -o -w massdns_output.txt -

• gobuster

  ex gobuster -m dns -u $TARGET.com -t 100 -w all.txt

• best dictonary file : all.txt

• scans.io

• commonspeak

• masscan

  ex: masscan -p1-65535 -iL $TARGET_LIST --max-rate 10000 -oG $TARGET_OUTPUT

• nmap

• brutespray

  masscan output => map services scan -oG => brutespray credential bruteforcing.

  ex: python brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

• Eyewitness

• waybackursls enumeration using wayback

• bXSS
• ezXSS
• XSS hunter
• KnoXSS
• Sleepy Puppy