> For the complete documentation index, see [llms.txt](https://wiki.pentestlist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery.md).

# Discovery

- [Email Address Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/email-address-discovery.md): How to find email addresses.
- [Subdomain Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/subdomain-discovery.md): How to find subdomains.
- [Data Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/data-discovery.md): How to find sensitive data.
- [Port & Service Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/port-and-service-discovery.md): How to find open ports and services