Reconnaissance active — Enum sous-domaines & infra

# Enumération simple
subfinder -d {{TARGET_DOMAIN}} -o subdomainstxt
# Avec résolution DNS
subfinder -d {{TARGET_DOMAIN}} -r -o subdomains-resolved.txt
# Avec toutes les sources
subfinder -d {{TARGET_DOMAIN}} -all -o subdomains-all.txt

# Mode passif (pas de bruteforce)
amass enum -passive -d {{TARGET_DOMAIN}} -o amass-passive.txt
# Mode actif
amass enum -active -d {{TARGET_DOMAIN}} -o amass-active.txt
# Intelligence (WHOIS, ASN, etc.)
amass intel -d {{TARGET_DOMAIN}} -whois

assetfinder --subs-only {{TARGET_DOMAIN}} | tee assetfindertxt

cat subdomainstxt amass-passive.txt assetfindertxt | sort -u > all-subs.txt
wc -l all-subs.txt

# massdns
massdns -r /opt/massdns/lists/resolvers.txt -t A -o S all-subs.txt > resolvedtxt
# dnsx
cat all-subs.txt | dnsx -silent -o live-subs.txt

# Recherche emails, sous-domaines, IPs
theHarvester -d {{TARGET_DOMAIN}} -b all -l 500 -f resultshtml
# Sources spécifiques
theHarvester -d {{TARGET_DOMAIN}} -b googlelinkedindnsdumpster

# Via API
curl "https://api.hunter.io/v2/domain-search?domain={{TARGET_DOMAIN}}&api_key={{HUNTER_API_KEY}}" | jq '.data.emails[].value'

# Via CLI
shodan search "org:{{TARGET_ORG}}" --fields ip_strportorg
# Hostnames d'une IP
shodan host {{TARGET_IP}}
# Filtres utiles
shodan search "hostname:{{TARGET_DOMAIN}} port:22"
shodan search "ssl.cert.subject.CN:{{TARGET_DOMAIN}}"

# Recherche d'hôtes par domaine
censys search "{{TARGET_DOMAIN}}" --index hosts
# ASN
censys search "autonomous_system.name: {{TARGET_ORG}}"

curl -s "https://crt.sh/?q=%25.{{TARGET_DOMAIN}}&output=json" | 
  jq -r '.[].name_value' | sort -u | grep -v '*'

whatweb http//{{TARGET}} -a 3 -v

wappalyzer http//{{TARGET}}

wafw00f http//{{TARGET}}

curl -sI http//{{TARGET}} | grep -i "server\|x-powered-by\|x-aspnet"

# BGP.he.net — chercher l'ASN
whois -h whoisradbnet -- '-i origin AS{{ASN}}' | grep "^route:" | awk '{print $2}'
# Via amass
amass intel -asn {{ASN}}
# Convertir ASN en CIDR
nmap --script targets-asn --script-args targets-asn.asn={{ASN}}