Passive

• Web Enumeration & Information Gathering
• Finding Website Ownership & IP Addresses
• Reviewing Webserver Metafiles For Information Leakage
• Search Engine Discovery
• Web App Fingerprinting
• Source Code Analysis
• Website Crawling & Spidering (Active)

Active

• Web Server Fingerprinting
• DNS Enumeration via Zone transfer
• Subdomain Enumeration
• Web App or Server Vulnerability Scanning
• File & Directory Enumeration or Brute-Force
• Automated Recon Frameworks