Whois Lookup
Forward lookup
whois {{domain}}When no server is specified, the whois client automatically attempts to guess the correct server based on the query object : domain, ip adder, fallback etc
whois {{domain}} -h {{192.0.0.1}}Replace {{192.0.0.1}} with your preferred whois server ip
Reverse lookup
whois {{Target_IP}}whois {{Target_IP}} -h {{192.0.0.1}}Replace {{192.0.0.1}} with your preferred whois server ip
Google Hacking
Web Technologies
- Netcraft DNS search page -> then site report
- wappalyzer lookup
Open Source Code
Tool : Tools that search through source code for secrets,
Note
Most of these tools require an access token to use the source code-hosting provider’s API and reply upon regular expressions or entropy-based detections to identify potentially useful information.
Shodan
Security headers and SSL/TLS
LLM Aided Enumeration
public information
Can you print out all the public information about structure of the company and employees working at {{domain}}
replace
{{domain}}with domain’s name
dorks
give me the best google dorks for {{domain}} website tailored for a penetration test engagement?
website technology fingerprinting
give me the technology stack of the {{domain}} website