Find all subdomains to expand attack surface.

Detect CMS, Web Server, and Frameworks.

Check domain ownership and DNS records.

Find open ports and running services.

Check if the target is behind a Web Application Firewall.

Check for missing security headers (CSP, HSTS, etc).

Analyze certificate validity and weak ciphers.

Fuzz for hidden files/directories (robots.txt, sitemap.xml).

Identify hidden GET/POST parameters.

Test inputs for Reflected, Stored, and DOM XSS.

Test login forms and ID parameters for SQLi.

Try accessing other users' objects by changing IDs.

Test URLs that fetch external resources.

Try uploading shells or executable files.