Scope Discovery

WHOIS looks for the owner of a domain or IP.

ViewDNS.info reverse WHOIS (https://viewdns.info/reversewhois/) is a tool that searches for reverse WHOIS data by using a keyword. nslookup queries internet name servers for IP information about a host.

ViewDNS reverse IP (https://viewdns.info/reverseip/) looks for domains hosted on the same server, given an IP or domain.

crt.sh (https://crt.sh/), Censys (https://censys.io/), and Cert Spotter (https://

sslmate.com/certspotter/) are platforms you can use to find certificate information about a domain.

Sublist3r (https://github.com/aboul3la/Sublist3r/), SubBrute (https://github.com/TheRook/subbrute/), Amass https://github.com/OWASP/Amass/), and Gobuster (https://github.com/J/gobuster/) enumerate subdomains.

Daniel Miessler's SecListshttps://github.com/danielmiessler/SecLists/) is a list of keywords that can be used during various phases of recon and hacking. For example, it contains lists that can be used to brute-force subdomains and filepaths.

Commonspeak2 (https://github.com/assetnote/commonspeak2/) generates lists that can be used to brute-force subdomains and filepaths using publicly available data.

Altdns (https://github.com/infosec-au/altdns) brute-forces subdomains by using permutations of common subdomain names.

Nmap (https://nmap.org/) and Masscan (htts://github.com/robertdavidgraham/masscan/) scan the target for open ports.

Shodan (https://www.shodan.io/), Censys (https://censys.io/), and Project Sonar (https://www.rapid7.com/research/project-sonar/) can be used to find services on targets without actively scanning them.

Dirsearch (https://github.com/maurosoria/dirsearch/) and Gobuster (https:// grthub.com/OJgobuster) are directory brute-forcers used to find hidden filepaths.

EyeWitness (https://github.com/FortyNorthSecurity/EyeWitness/) and Snapper (https://github.com/dxa4481/Snapper/) grab screenshots of a list of URLs. They can be used to quickly scan for interesting pages among a list of enumerated paths.

OWASP ZAP https://awasp.org/www-project-zap/) is a security tool that includes a scanner, proxy, and much more. Its web spider can be used to discover content on a web server.

GrayharWarfare (https://buckets.grayhatwarfare.com/) is an online search . It can be used github.com./ethOizzle/bucket-stream/) brute-force buckets by using keywords.

Lazys3 (http://github.com/nahamsec/lazys3/) and Bucket Stream (ntpx/) engine you can use to find public Amazon S3 buckets.