recon get subdomains by crt.sh and subfinder get subdomains ip s scan all ports check the ports that has http protocol soon : take screenshots with eyewitness pass subdomains to nuclei