1. DNS
    1. netcraft.com
    2. whois
  2. Google dorking (filetype:pdf) etc.
  3. StackOverflow
  4. Shodan (for public facing)
  5. Github
  6. TheHarvester - automate OSINT on user emails
  7. Social Searcher - deep dives on social media
  8. https://osintframework.com/
  9. Recon-ng