In this article, I will share information about a manual recon process through which you can find juicy endpoints 🍒 and possibly discover the original IP 🌍, which can be useful for chaining critical vulnerabilities! 🔓

Three services are used in this process:

1) VirusTotal.com 🦠

This service is widely used in various tools, like Subdinder, etc. Here, we use their API key to fetch data regarding the domain.

URL: https://www.virustotal.com/vtapi/v2/domain/report?domain=<domain>&apikey=<API_KEY>

Simply replace <domain> with your target and <API_KEY> with your own API key 🔑, and you're good to go! ✅

2) AlienVault.com 👽

This service is also well-known for the recon process. Many of you may not be aware of this manual recon process, so here's how you can use it:

API endpoint: https://otx.alienvault.com/api/v1/indicators/hostname/<DOMAIN>/url_list?limit=500&page=1

Just replace <DOMAIN> with your target subdomain, and you're all set! Note: No API key is needed for this one! 🚫🔑

3) URLScan.io 🔍

URLScan allows you to search for domain-related information. While some features require a subscription 💳, you can still access a lot of data with the free plan! 🎉

API endpoint: https://urlscan.io/api/v1/search/?q=domain:<DOMAIN>&size=10000

Again, replace <DOMAIN> with your target subdomain.

Conclusion:

With the help of these tools 🛠️, you can find JavaScript files, sensitive text files 📄, PDFs with exposed information 🔓, and even the original IP addresses 🌐!

If you have any doubts, feel free to DM me on LinkedIn or leave a comment below! 💬