Identifying Our Target

• Targets can be found on Bug Bounty Programs.
• Make sure to read the Rules of Engagement during a pentesting or Scope during Bug Bounty.

Discovering/Verifying Email Addresses

• Some Resources to find email addresses associated to Target company.

  • Hunter.io
  • Phonebook.cz
  • voilanorbert.com
  • clearbit.com (Chrome Extension)
  • h8mail ( ‣) —> Email OSINT

• Verifying Email Address (To make sure if they are valid)

  • EMAILHIPPO ( verifyemailaddress.io )
  • email-checker.net
  • Also gmail password reset may help to verify if the email is valid or not
  • There are plenty of CLI tools on github as well.

Gathering Breached Credentials (Tools)

• Hunting Breached Credentials (Tools/Scripts)
  • h8mail ( ‣) —> Email OSINT
  • WhatBreach ( https://github.com/Ekultek/WhatBreach )
  • Breach-Parse ( https://github.com/hmaverickadams/breach-parse)
• Hunting Breached Credentials (Websites/Services)
  • dehashed.com
  • haveibeenpwned.com

Subdomain Enumeration

• Subdomain Enumeration Tools

  • Frogy ( ‣)
  • Sublist3r
  • SubFinder
  • https://crt.sh
  • Owasp Amass
  • FindDomain
  • DNSsearch
  • Sudomy

• Dictionary Attacks

  • Knockpy
  • DNSRecon
  • MassDNS
  • AltDNS (Purmutation Scanning) ( https://github.com/infosec-au/altdns )

• DNS Databases

  • DNS Dumpster (https://dnsdumpster.com/)
  • Shodan ( https://snippets.shodan.io/c/83ldc9nef1Tp2R8C )
  • Pentest-Tools ( https://pentest-tools.com/information-gathering/find-subdomains-of-domain )
  • Rapid-7 Forward DNS ( https://opendata.rapid7.com/sonar.fdns_v2/ )

• Subdomain Alive or Not

  • httprobe
  • Urlchecker
  • dnsx
  • httpx ( https://github.com/projectdiscovery/httpx)

• Some Useful Subdomain Enumeration Blogs To Read

  • A detailed Comparison of Subdomain Enumeration Tools ( https://blog.yeswehack.com/yeswerhackers/subdomains-tools-review-full-detailed-comparison/ )
  • Subdomain Enumeration Guide in Depth ( https://sidxparab.gitbook.io/subdomain-enumeration-guide/ )
  • AssetFinder: A Handy Subdomain and Domain Discovery Tool (https://securitytrails.com/blog/assetfinder)
  • The Complete Subdomain Enumeration Guide (https://link.medium.com/05MZLCsF0hb)
  • Subdomain Enumeration Tools (thexssrat) ( https://github.com/The-XSS-Rat/SecurityTesting/blob/master/SubDomainEnum.md )

Identifying Website Technologies