> For the complete documentation index, see [llms.txt](https://h3ckt0r.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://h3ckt0r.gitbook.io/0xsec/elite/web_appsec/reconnaissance/scope.md).

# Scope

### **Small Scope**

Only Specific URLs are part of Scope. This usually includes staging/dev/testing or single URLs.

* [ ]  Directory Enumeration
* [ ]  Technology Fingerprinting
* [ ]  Port Scanning
* [ ]  Parameter Fuzzing
* [ ]  Wayback History
* [ ]  Known Vulnerabilities
* [ ]  Hardcoded Information in JavaScript
* [ ]  Domain Specific GitHub & Google Dorking
* [ ]  Broken Link Hijacking
* [ ]  Data Breach Analysis
* [ ]  Misconfigured Cloud Storage

### **Medium Scope**

Usually the scope is wild card scope where all the subdomains are part of scope

* [ ]  Subdomain Enumeration
* [ ]  Subdomain Takeover
* [ ]  Probing & Technology Fingerprinting
* [ ]  Port Scanning
* [ ]  Known Vulnerabilities
* [ ]  Template Based Scanning (Nuclei/Jeales)
* [ ]  Misconfigured Cloud Storage
* [ ]  Broken Link Hijacking
* [ ]  Directory Enumeration
* [ ]  Hardcoded Information in JavaScript
* [ ]  GitHub Reconnaissance
* [ ]  Google Dorking
* [ ]  Data Breach Analysis
* [ ]  Parameter Fuzzing
* [ ]  Internet Search Engine Discovery (Shodan, Censys, Spyse, etc.)
* [ ]  IP Range Enumeration (If in Scope)
* [ ]  Wayback History
* [ ]  Potential Pattern Extraction with GF and automating further for XSS, SSRF, etc.
* [ ]  Heartbleed Scanning
* [ ]  General Security Misconfiguration Scanning

### **Large Scope**

Everything related to the Organization is a part of Scope. This includes child companies, subdomains or any labelled asset owned by organization.

* [ ]  Tracking & Tracing every possible signatures of the Target Application (Often there might not be any history on Google related to a scope target, but you can still crawl it.) ​
* [ ]  Subsidiary & Acquisition Enumeration (Depth – Max)​
* [ ]  Reverse Lookup
* [ ]  ASN & IP Space Enumeration and Service Identification​
* [ ]  Subdomain Enumeration
* [ ]  Subdomain Takeover
* [ ]  Probing & Technology Fingerprinting
* [ ]  Port Scanning
* [ ]  Known Vulnerabilities
* [ ]  Template Based Scanning (Nuclei/Jeales)
* [ ]  Misconfigured Cloud Storage
* [ ]  Broken Link Hijacking
* [ ]  Directory Enumeration
* [ ]  Hardcoded Information in JavaScript
* [ ]  GitHub Reconnaissance
* [ ]  Google Dorking
* [ ]  Data Breach Analysis
* [ ]  Parameter Fuzzing
* [ ]  Internet Search Engine Discovery (Shodan, Censys, Spyse, etc.)
* [ ]  IP Range Enumeration (If in Scope)
* [ ]  Wayback History
* [ ]  Potential Pattern Extraction with GF and automating further for XSS, SSRF, etc.
* [ ]  Heartbleed Scanning
* [ ]  General Security Misconfiguration Scanning
* [ ]  And any possible Recon Vector (Network/Web) can be applied.​