1. Domain and Infrastructure

1. Identify the primary domain¶

[ ] Confirm the root domain and who owns it
Confirm the root domain (strip any subdomain, e.g. app.onetec.com → onetec.com).
Watch for two-part endings like .co.uk.

whois onetec.com

dig +short onetec.com

[ ] Find all subdomains under the root
```
subfinder -d onetec.com -o subs.txt
```

Alternatives for more coverage:

amass enum -d onetec.com
assetfinder --subs-only onetec.com

## Resolve discovered domains

[ ] Find which resolved hosts serve a working site

httpx -l resolved.txt -sc -title -o live.txt

Faster for many hosts:

naabu -l resolved.txt -o ports.txt

[ ] Find the IPs and who hosts them

dig +short onetec.com
whois <IP-address>
asnmap -d onetec.com

[ ] Pull the main record types

dig +short A onetec.com
dig +short MX onetec.com
dig +short NS onetec.com
dig +short TXT onetec.com

[ ] Find subdomains and related domains from certificates Website: search onetec.com on crt.sh

Command line:

curl -s "https://crt.sh/?q=onetec.com&output=json" | jq -r '.[].name_value' | sort -u

Manual check:

dig +short onetec.com
whois <the-IP>

[ ] Look at response headers for proxy clues
```
curl -sI https://onetec.com
```

[ ] Hunt for dev, staging, test, uat, qa hosts

grep -E "dev|staging|test|uat|qa|preprod" subs.txt

echo | openssl s_client -connect <IP>:<PORT> 2>/dev/null | openssl x509 -noout -text