- Query internet scanners for the org’s exposed panels Precise Shodan and Censys queries surface login portals, dev tools, and databases tied to the target without touching it.
- Correlate people and breaches for credential access Map employees to email formats, then check breach and combo data to seed targeted password spraying.
- Find virtual hosts hidden behind shared IPs One IP can serve many sites keyed by Host header; brute the header to reach internal apps not in DNS.
- Hunt organization secrets across GitHub Employees leak keys in personal repos, gists, and commit history; search by org, domain, and internal identifiers.
- Discover cloud storage by permutation Generate likely bucket and blob names from the org's keywords, then check S3, GCS, and Azure for readable or writable stores.
- Recover historical endpoints and parameters from archives Old crawls hold deprecated endpoints and parameter names that are frequently still live and less guarded.
- Extract endpoints and secrets from JavaScript bundles Front-end bundles list API routes, parameters, and sometimes keys the rest of the site never links to.
- Pivot on favicon hashes to find related hosts A favicon hash uniquely fingerprints an app, so searching for it in Shodan or Censys surfaces every host running the same stack.
- Pivot from ASN to the full external footprint Start from the organization's ASN to enumerate owned IP ranges, then scan those for assets DNS does not reveal.
- Mine certificate transparency for hidden subdomains CT logs record every issued certificate, exposing internal and staging hostnames DNS brute force never finds.