[batman5464]

Recon: Acquisitions and Domains

> ASN Analysis
> SSL Recon
> Shodan
> Reverse DNS
> ReconGTP
> Scope
> Google-fu
> Reverse WHOIS
> Reverse DNS
> Reverse IP
> Crunchbase ++
> DMARC Analysis
> Analytics Relationships
> Supply chain investigation and SaaS
> TLDs Scanning
> Enumeration for Apex Domains

Recon: Subdomain Enumeration
> Security Trails + Netlas
> Brute force
> Subdomain Scraping
> Permutation Scanning
> Linked Discovery
> Wildcards
> Wordlists
> Advantageous Subs (WAF bypass - Origins)
> Favicon analysis
> Sub sub domains
> Esoteric techniques

Recon:

> Port Scanning
> Service Bruteforce
> Tech Stack
> Understanding the target framework to find perfect CVEs