# Discovery

- [Email Address Discovery](/offensive-security/external-infrastructure/discovery/email-address-discovery.md): How to find email addresses.
- [Subdomain Discovery](/offensive-security/external-infrastructure/discovery/subdomain-discovery.md): How to find subdomains.
- [Data Discovery](/offensive-security/external-infrastructure/discovery/data-discovery.md): How to find sensitive data.
- [Port & Service Discovery](/offensive-security/external-infrastructure/discovery/port-and-service-discovery.md): How to find open ports and services