SUBDOMAIN ENUMERATION

🎯 1. Target Selection

• [ ] Read program scope

• [ ] Identify scope type (Large / Medium / Small)

• Large scope - Any FIS asset is in scope

• [ ] crunchbase dorking

• [ ] pick any one target form crunchbase dorks, that have good features

• [ ] do subdomain enumeration (subdog, subfinder, favinfo)

• [ ] naabu scan on all the gathered subdomains ( naabu, nmapscan )

• [ ] Run VYRE on naabu, nmapscan results (HTTPX , VYRE)

• [ ] Run HTTPX

  fuzzing on status codes Always fuzz:
  403
  302
  301
  404
  200
  

• [ ] Run Techfinder

• [ ] Run katana, jscrawler, hakrawler, urlflux on alive subdomains

• [ ] Run waymore on all gathered subdomains

• [ ] seperate all urls and js files.

• [ ] run secyra and jsluice on js files and nuclei templates to find exposures, manual hunting ( to find api keys, usernames, passwords)

• Medium scope - *.fisglobal.com

  • [ ] Run VYRE on naabu results (HTTPX , VYRE)

  • [ ] Run HTTPX

    fuzzing on status codes Always fuzz:
    403
    302
    301
    404
    200
    

  • [ ] Run Techfinder

  • [ ] Run katana, jscrawler, hakrawler on alive subdomains ( * run urlflux )

  • [ ] Run waymore on all gathered subdomains

  • [ ] seperate all urls and js files.

  • [ ] run secyra and jsluice on js files and nuclei templates to find exposures, manual hunting ( to find api keys, usernames, passwords)