DNS
OSINT
Active recon
Initial scanning
More recon
Specific recon, like for application, cloud, APIs, etcetera.
To gain information for initial access.
These pages exist in other documentation:
A canopy of apple-blossom
Head in the clouds
API Mayhem