OSINT and Dorking

aOwler - Company acquisitions Crunchbase - paid Hackertarget - DNS records database LEAKIX -DNS records database

site:site.com | find specific website -site:site.com | ignore specific website

filetype: pdf,txt,csv

bgpview.io - ASN

BadDNS (BLS) Subdomain take over - set a SaaS to an abandoned internal url CNAME record. Reregister an expired SaaS for yourself and take advantage of the CNAME that points to it

Webcap (BLS) - gowitness, take screenshots of websites

hunter.io TheHarvester

haveibeenpwned