Recon tools: amass
What is amass? I'm a big fanboy of many of the owasp tools, like zaproxy, but in this case lets talk a little bit about amass. Like many other tools, it's good for searching for subdomains and subdomain bruteforcing, but it does so much more than that. In this example, simply asking amass to enumerate the domain feemcotech.solutions (amass enum -d feemcotech.solutions) we get more than just subdomains, we get various records and information available about the resolutions and ips related as well. feemcotech.solutions (FQDN) --> mx_record --> mx00.ionos.com (FQDN) feemcotech.solutions (FQDN) --> mx_record --> mx01.ionos.com (FQDN) blog.feemcotech.solutions (FQDN) --> a_record --> 74.208.236.20 (IPAddress) blog.feemcotech.solutions (FQDN) --> aaaa_record --> 2607:f1c0:100f:f000::200 (IPAddress) 74.208.0.0/16 (Netblock) --> contains --> 74.208.236.20 (IPAddress) 8560 (ASN) --> managed_by --> ONEANDONE-AS Braue...