> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/network/external-recon.md).

# External Recon

### O365/Entra

See [Recon](/red-team/cloud/azure-o365/recon.md)

### Subdomains

Enumerating subdomains is vital for attack surface mapping. A huge amount of tools and methods exist for this, such as visiting [crt.sh](https://crt.sh/) or using Gobuster. I recommend using a blend of tools/sources, such as:

* [Subfinder](https://github.com/projectdiscovery/subfinder)
* [GoBuster](https://github.com/OJ/gobuster) (DNS Mode)
* [Sublist3r](https://github.com/aboul3la/Sublist3r)

Use a port scanner (like RustScan) to scan targets and Gowitness to triage hosted web applications for investigation.