Certificate Transparency Logs
crt.sh
curl -s "https://crt.sh/?q=facebook.com&output=json" | jq -r '.[]
| select(.name_value | contains("dev")) | .name_value' | sort -uThis above code will output any domain in facebook with the domain containing “dev” and remove duplicates
Fingerprinting
This is to see the technologies a site uses with stuff like Wappalyszer. I know this stuffI think enough to not take notes.
Wafw00f
wafw00f inlanefreight.comGobuster
gobuster vhost -u http://inlanefreight.htb:81 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domainGrab vhosts on a target
Nikito
nikto -h inlanefreight.com -Tuning bFinished the learning of the day doing CBBH - Recon - Skill Assessment