Bug Bounty Checklist

Search Engine Operators (Google Dorking)

WHOIS Lookup

DNS Enumeration

SSL/TLS Analysis

Historical Data & Archives

Online Certificate Transparency Logs

Publicly Available Documents & OSINT

Network Footprinting (Limited Passive)

Subdomain Enumeration

Email & Credential Harvesting

Cloud Infrastructure Recon

GitHub & Code Recon

Network Scanning

Port Scanning (Nmap)

Web Directory Brute-forcing

Vulnerability Scanners

Automated Recon Tools

Network Vulnerability Scanners

CMS Specific Scanners