Subdomains
IPs
Port Scanning
Tech Fingerprinting -> CVEs
Content Discovery