Source code Default creds

v host - gobuster

vuln scanning / googling Brute force

timing errors to enum users

Strings files Steg hide images

searchsploit

metasploit search msfconsole for known shii