Query internet scanners for the org’s exposed panels
Precise Shodan and Censys queries surface login portals, dev tools, and databases tied to the target without touching it.
Tag: recon
Correlate people and breaches for credential access
Map employees to email formats, then check breach and combo data to seed targeted password spraying.
Find virtual hosts hidden behind shared IPs
One IP can serve many sites keyed by Host header; brute the header to reach internal apps not in DNS.
Hunt organization secrets across GitHub
Employees leak keys in personal repos, gists, and commit history; search by org, domain, and internal identifiers.
Discover cloud storage by permutation
Generate likely bucket and blob names from the org's keywords, then check S3, GCS, and Azure for readable or writable stores.
Recover historical endpoints and parameters from archives
Old crawls hold deprecated endpoints and parameter names that are frequently still live and less guarded.
Extract endpoints and secrets from JavaScript bundles
Front-end bundles list API routes, parameters, and sometimes keys the rest of the site never links to.
Pivot on favicon hashes to find related hosts
A favicon hash uniquely fingerprints an app, so searching for it in Shodan or Censys surfaces every host running the same stack.
Pivot from ASN to the full external footprint
Start from the organization's ASN to enumerate owned IP ranges, then scan those for assets DNS does not reveal.
Mine certificate transparency for hidden subdomains
CT logs record every issued certificate, exposing internal and staging hostnames DNS brute force never finds.