Enumeration methodology

Passive

☐ whois [DOMAIN_NAME]
☐ nslookup [OPTIONS] [DOMAIN_NAME] [SERVER]
options: a, aaaa, mx, txt, soa (start of authority)
server: cloudflare: 1.1.1.1 or 1.0.0.1, google: 8.8.8.8 or 8.8.4.4, quad9: 9.9.9.9
☐ dig [DOMAIN_NAME] [TYPE]
type: options above
☐ DNS Dumpster
☐ Shodan.io
☐ View page source for comments (CTF style)
☐ wappalyser
☐ robots.txt
☐ sitemap.xml
☐ Wayback machine: https://archive.org/web/
☐ Github source code
☐ site:*.domain.com -site:www.domain.com

Active

☐ ping
☐ traceroute or tracert
☐ telnet (not imp)
☐ Banner grabbing:
• nc [MACHINE_IP}
• whatweb [MACHINE_IP}
• whatweb --no-errors [network_ip_range]
•
☐ View certificates in https site ☐ Add domain to /etc/hosts: echo "[IP] [domain]" | sudo tee -a /etc/hosts
☐ Extension fuzzing: using burp-parameter and /indexFUZZ
☐ Directory and file fuzzing
☐ Subdomain enumeration
☐ vhosts enumeration
☐

Wordlists to use: Wordlists