subdomain_discovery: uses_tool: [ amass-passive, subfinder, sublist3r ] thread: 10 amass_wordlist: default subfinder_config: config_short_name amass_config: config_short_name port_scan: ports: [ top-100 ] exclude_ports: null thread: 10 visual_identification: port: xlarge thread: 2 dir_file_search: extensions: [ php,asp,aspx,txt,conf,db,sql,json ] recursive: false recursive_level: 1 thread: 100 wordlist: default fetch_url: uses_tool: [ gau, hakrawler ] # intensity will define how the URLs will be fetched # Available Options: normal, aggressive # normal: will fetch urls only for the main domain, subdomains urls will not be fetched # aggressive: will fetch urls for all the subdomains intensity: aggressive # To learn more about YAML config visit the official documentation at https://rengine.wiki/pentester/scan_engine/