Website

How to gather information from a website

There's also a Domain / IPbut here we will talk about website itself not DNS, Reputation, ...

Methodology

• Host

• Whois

  • Whois

  • Whois history

• Web Application Firewall

  • WafW00f

  • WhatWAF

  • Real IP

• Technologies

  • WhatWeb

  • BuiltWith

  • Wappalyzer

• Subdomains

  • Search Engines

  • Amass

  • Subfinder

  • Sublist3r

  • AssetFinder

  • MerkleMap

  • phonebook.cz

• Certificate

  • CRT.sh

• Other domains

  • AnalyzeID

  • AssetFinder

• URL

  • phonebook.cz

• Email

  • phonebook.cz

• Archives

• Explore website to gather (email, phone, social networks, physical addresses, names)

Useful

Host

host <domain>

Whois

whois <domain>

Web Technologies

whatweb <domain.name>

whatweb <domain.name> -a 3

Resources

Website

Archives

https://web-beta.archive.org/#/web-beta.archive.org

Internet Archive: Wayback Machine

Subdomains

Subdomain search engine | Merklemap

Tools

Identify Web Application Firewall

GitHub - EnableSecurity/wafw00f: WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.GitHub

Identify Web Application Firewall

GitHub - Ekultek/WhatWaf: Detect and bypass web application firewalls and protection systemsGitHub

Identify Technologies

GitHub - urbanadventurer/WhatWeb: Next generation web scannerGitHub