Deeper

1. WHOIS <target.com>
2. Sub Domain Enumeration (Use to discover DNS names that belong to the target**)** - Using DNS records ( dnsenum , amass ) - Using Brute forcing methods ( ffuf, Gobuster) → VHosts fuzzing to Discover sub-domain (Use it to map an ip address to a file on the server) - Tools used (Gobuster, Feroxbuster, ffuf) → Certificate Transparency (CT) Logs for Subdomain enumeration - Tools used (crt.sh , Censy )
3. Crawling

• Using Scrapy
• Using ZAP automated crawler

4. Checking The .Well-known file
5. Google Dorking/Yandex dorking
6. After all use an automated Recon tool
7. Fingerprinting - Using tools like Built-With

• Also using the Wafw00f tool to discover a WAF

8. Using A Vulnerability Scanner

• Nikto

9. Directory and File FUZZING

• Using FFuf and Gobuster
• Api FUZZing

10. JS Recon