[Pajeeter]

get to know the target (the website)
you should find the subdomains first you can use http://subdomainfinder.c99.nl/ it has logs of subdomains even if they change.
you could also use https://dnsdumpster.com/ it scans the dns records to see if the website has subdomains.
or you could bruteforce using  fierce or go-buster youd need a good list of subdomains from https://github/danielmiessler/Seclists

after that look for outdated server anonymous FTP open etc you get what im saying nigger.
if you find a subdomain that has a default index page like nginz or centos or apache you use go-buster to bruteforce the  directories youll prob find something worth looking at then you need to test the api calls youd use something like burp-suite for that and the extension called foxyproxy
 
you turn on burp-suite and the extension and just carry on using the website like a normal user after finished using all the functionalities you can go and look at the requests logs to find some shit like IDORs and BACS etc.

goodluck niggers.

[thegodofall]

Thank you for the tutorial, looks helpful!

[anonbrake47]

Good information bro

[yvngrich]

I love it, I'm going to hack NASA

[udy4t]

This information is Pajeeter level TOP information

[0devz]

pajeet top secret info

[dvx]

Thanks for this detailed recon, fuzzing and web penetration technique and methods guide. Will use it to penetrate FBI portals!

[hostedbf0]

good tutorial bro