Enumeration and exploitation

Terminal logging
Subdomain Discovery
Port scanning
Enumerating common ports and services

Terminal logging

Always start logging terminal history before running any commands:

script -f ./history-<tab_number>.log

Subdomain Discovery

Google: site:*.<domain>
Sublist3r (better use VPN in case of blocks):

python ~/sublist3r/sublist3r.py -d <domain> -o domains.txt -t 1

Port scanning

Scan common TCP ports of domains listed in the file:

nmap -v -sV -sC -iL ./domains.txt -oN nmap.txt

Scan common TCP ports:

nmap -v -sV -sC <single_ip_or_range>

Aggressively SYN scan all TCP ports:

sudo nmap -v -p- -sS -A <single_ip_or_range>

Scan all TCP ports for known vulnerabilities:

sudo nmap -v -p- --script vuln <single_ip_or_range>

Aggressively scan common UDP ports:

sudo nmap -v --top-ports 20 -A -sU <single_ip_or_range>

Enumerating common ports and services