Here are some links to resources for researching domains. These are online website tools or tools on github that need to be downloaded/installed. These tools can be very useful in when you are investigating domains, subdomains and website technologies. An account might need to be create for some of the online tools in order to use them.
You can start with google.com to see what’s out there.
Search terms:
tcm-sec.com"tcm-sec.com"site:tcm-sec.comsite:tcm-sec.com heathsite:tcm-sec.com heath -academyGather as much information as you can about the target site.
Some of these sites can search using multiple types of data.
Podcast on a penetration test, social engineering, incident response:
darknetdiaries.com/episode/22
When hunting down subdomains you are looking for developer or staging versions of a site, or admin login pages that are not public or easily found on the internet.
Website tools are not the best way to scan for subdomains, but you can try google and a couple others to see if anything interesting shows up.
site:tesla.comsite:tesla.com -wwwsite:tesla.com -www -forums inurl:devsite:tesla.com -www -forums inurl:adminsite:tesla.com -www -forums inurl:consolepentest-tools.com - scans are limited and you may have to create an account now.
pentest-tools.com/information-gathering/find-subdomains-of-domain
spyse.com - Shut down.
%.tesla.comshodan.io - Website tool to discover all kinds of stuff connected to the internet.
anydomain.com - but may work better with an Ip address.city:atlanta - you should see quite a few results.city:atlanta port:3389 - check for remote desktop.city: atlanta port:3389 org:choopa - specific organization.city: atlanta port:3389 org:choopa-business - narrow it down more.web.archive.org - non-profit library of millions of free books, movies, music, websites, etc.
https://anydomain.com - the highlighted spots are where you can find screenshots.https://amazon.com - should show some versions of the site from a long time ago.