# Website OSINT

BuiltWith -  <https://builtwith.com/>

Domain Dossier -  <https://centralops.net/co/>

DNSlytics -  <https://dnslytics.com/reverse-ip>

SpyOnWeb -  <https://spyonweb.com/>

Virus Total -  <https://www.virustotal.com/>

Visual Ping -  <https://visualping.io/>

Back Link Watch -  <http://backlinkwatch.com/index.php>

View DNS -  <https://viewdns.info/>

crt.sh -  <https://crt.sh/>

Pentest-Tools Subdomain Finder -  [https://pentest-tools.com/information-gathering/find-subdomains-of-domain#](https://pentest-tools.com/information-gathering/find-subdomains-of-domain)

Spyse -  <https://spyse.com/>

Shodan - [https://shodan.io](https://shodan.io/)

Wayback Machine -  <https://web.archive.org/>

Open Corporates -  <https://opencorporates.com/>

AI HIT -  <https://www.aihitdata.com/>

whois tcm-sec.com

nano \~/.bashrc

&#x20;export GOPATH=$HOME/go

export GOROOT=/usr/lib/go

export PATH=$PATH:$GOROOT/bin:$GOPATH/bin

&#x20;source \~/.bashrc

&#x20;go install github.com/tomnomnom/httprobe\@latest

&#x20;go install github.com/tomnomnom/assetfinder\@latest

&#x20;GO111MODULE=on

&#x20;go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder\@latest

&#x20;go install github.com/sensepost/gowitness\@latest

&#x20;export GO111MODULE=on

&#x20;go install -v github.com/OWASP/Amass/v3/...\@master

&#x20;

&#x20;subfinder -d tcm-sec.com

assetfinder tcm-sec.com

amass enum -d tcm-sec.com

&#x20;

cat tesla.txt | sort -u | httprobe -s -p https:443

&#x20;gowitness file -f ./alive.txt -P ./pics --no-http

&#x20;

Subfinder -  <https://github.com/projectdiscovery/subfinder>

Assetfinder -  <https://github.com/tomnomnom/assetfinder>

httprobe -  <https://github.com/tomnomnom/httprobe>

Amass -  <https://github.com/OWASP/Amass>

GoWitness -  <https://github.com/sensepost/gowitness/wiki/Installation>

**Automatic Website OSINT**

\#!/bin/bash

&#x20;domain=$1

RED="\033\[1;31m"

RESET="\033\[0m"

&#x20;info\_path=$domain/info

subdomain\_path=$domain/subdomains

screenshot\_path=$domain/screenshots

&#x20;if \[ ! -d "$domain" ];then

mkdir $domain

fi

&#x20;if \[ ! -d "$info\_path" ];then

mkdir $info\_path

fi

&#x20;if \[ ! -d "$subdomain\_path" ];then

mkdir $subdomain\_path

fi

&#x20;if \[ ! -d "$screenshot\_path" ];then

mkdir $screenshot\_path

fi

&#x20;echo -e "${RED} \[+] Checkin' who it is...${RESET}"

whois $1 > $info\_path/whois.txt

&#x20;echo -e "${RED} \[+] Launching subfinder...${RESET}"

subfinder -d $domain > $subdomain\_path/found.txt

&#x20;echo -e "${RED} \[+] Running assetfinder...${RESET}"

assetfinder $domain | grep $domain >> $subdomain\_path/found.txt

&#x20;\#echo -e "${RED} \[+] Running Amass. This could take a while...${RESET}"

\#amass enum -d $domain >> $subdomain\_path/found.txt

&#x20;echo -e "${RED} \[+] Checking what's alive...${RESET}"

cat $subdomain\_path/found.txt | grep $domain | sort -u | httprobe -prefer-https | grep https | sed 's/https\\?:\\/\\///' | tee -a $subdomain\_path/alive.txt

&#x20;echo -e "${RED} \[+] Taking dem screenshotz...${RESET}"

gowitness file -f $subdomain\_path/alive.txt -P $screenshot\_path/ --no-http
