Methodology overview

Physical / Social

Location information (satellite / drone image, building layout)

Job information (name, job title, managers, pictures, badges, desk, computers)

Web / Host

• Target Validation
• Finding Subdomains
• Fingerprinting
• Data Breaches

Legend

• gray : website
• blue : application
• green : extension

Identify our target

Bugcrowd : public bug hunting

Email & personal discovering

*hunter.io* : email research

Phonebook.cz : search for domains, emails, Urls (give a lot of emails)

*voilanorbert.com* : same as hunter.io

clearbit connect : chrome extension