# Website

When beginning recon on a domain, the first thing to do is to view the webpage. Have a look around and become familiar with the layout.&#x20;

Make a note of important things like

## Who is

the next thing to do is WhoIs to find out information about who owns and created the domain.

These commands can be used to resolve the DNS

```
host website.com
nslookup website.com
```

Whois can then be used with the IP you get from resolving the DNS

```
whois 192.168.1.101
```

### Website OSINT tools

* BuiltWith – https://builtwith.com/
* Domain Dossier – https://centralops.net/co/
* DNSlytics – https://dnslytics.com/reverse-ip
* SpyOnWeb – https://spyonweb.com/
* Virus Total – https://www.virustotal.com/
* Visual Ping – https://visualping.io/
* Back Link Watch – http://backlinkwatch.com/index.php
* View DNS – https://viewdns.info/

### Search for website <a href="#search-for-website" id="search-for-website"></a>

* Domain dossiers can be used to scan domains.
* Who is record – who owns the website
* DNS records – find where email may be hosted
* reddit.com/domain/domain.com

### Website OSINT Tools <a href="#website-osint-tools" id="website-osint-tools"></a>

* Subfinder – https://github.com/projectdiscovery/subfinder
* Assetfinder – https://github.com/tomnomnom/assetfinder
* httprobe – https://github.com/tomnomnom/httprobe
* Amass – https://github.com/OWASP/Amass
* GoWitness – https://github.com/sensepost/gowitness/wiki/Installation
* Wappalyzer (firefox extension)
