Gathering Information

You can start with google.com to see what’s out there.

Search terms:

• tcm-sec.com
• "tcm-sec.com"
• site:tcm-sec.com
• site:tcm-sec.com heath
• site:tcm-sec.com heath -academy
• Check images if no sites/domains show up.

Gather as much information as you can about the target site.

• IP addresses
• Physical addresses
• Google tags/analytics
• Technology

Websites and online tools

Some of these sites can search using multiple types of data.

• builtwith.com
• centralops.net/co
• urlscan.io
• httpsdnslytics.com/reverse-ip
• spyonweb.com
  • URL, IP Address, pub-xxxxxxxxxx or UA-xxxxxxx
• virustotal.com
• reddit.com
  • reddit.com/domain/thecybermentor.com
• visualping.io
• backlinkwatch.com
  • You might find extra connections here.
• viewdns.info
• dnsdumpster.com
• hackertarget.com
• dnstools.ws
• isc.org/dns-tools
• iplocation.io/all-dns-records-of-domain
• mxtoolbox.com/ReverseLookup.aspx
• nmmapper.com/sys/tools/subdomainfinder
• dnslytics.com

Internet Services (IP, ISP, location)

• lg.he.net
• bgp.he.net
• play.google.com/store/apps/details?id=net.he.networktools

DNS Techniques:

• securitytrails.com/blog/dns-enumeration
• systemweakness.com/dns-analysis-ca637eab0180

Podcast on a penetration test, social engineering, incident response:
darknetdiaries.com/episode/22

Tools on github

• github.com/smicallef/spiderfoot
• github.com/topics/dns-lookup
• github.com/Manisso/Crips
• github.com/TermuxHackz/X-osint
• github.com/BullsEye0/ghost_eye
• github.com/h3x0crypt/HostSpider
• github.com/aaronjwood/PortAuthority
• github.com/akashblackhat/dark_web.py
• github.com/dievus/msdorkdump