OSINT

WHOIS

-Looking for Names and Emails and then possibly spearfish

-Nameservers reveal how a site is structured

-DNSSEC: Signed or Unsigned

https://www.whois.com/whois/

whois google.com

EMAIL Harvesting

sudo theHarvester -d compuquip.com -l 500 -b google,linkedin,twitter,bing

Subdomain Enumeration

sudo sublist3r -d google.com

DNS

sudo nmap -p 53 —script dns-brute compuquip.com

sudo dnsmap zonetransfer.me -w /opt/SecLists/Discovery/DNS/dns-Jhaddix.txt