• [ ] What is target’s footprint?
• [ ] Domain?
• [ ] Subdomain?
• [ ] IP ranges?
• 3rd party accounts?
• [ ] Employees?
• Read the source-code:
• [ ] Try to know more about target’s infrastructure
• [ ] Use your eyes
• Stats