Useful Tools (Defensive & Discovery)
check-host.net
check-host.net – our primary information source. We use it to find out where the target is located and how its defense mechanisms work. This site is also used to check the availability of the target, which is useful during load testing. Remember this tool: its functionality will be explained in more detail in following articles.

FOFA / Search Engines
There are specialized search engines for pentesters. We use them to quickly identify which services (aka ports) are running on a target, and sometimes to discover the real backend IP hidden behind a CDN such as Cloudflare. Here’s our top 4 search engines:

ping.pe
ping.pe – a more advanced alternative to Check-Host. We use its MTR (multi-trace route) tool for advanced L4 testing. Sometimes the routers providing internet access to the target are more vulnerable than the target itself.