---
title: "Assets"
canonical: "https://kb.cynergy.app/space/GS/720896009/Assets"
format: markdown
---
## **Top-Level Domain**
You will see your top-level domains on this page, and you could add domains by clicking on **“ADD DOMAIN.” **
> ℹ️ ### The test you run for you top-level domains are:
> ℹ️
> ℹ️ ### ***Discovery scan:***
> ℹ️
> ℹ️ - Map organization's external-facing assets
> ℹ️ - Map organization's cloud-based assets (AWS S3, Microsoft Blobs, Google GCP, etc.)
> ℹ️ - Validation process of discovered assets
> ℹ️ - Enumerate valid assets accessible services
> ℹ️ - Collect screenshot evidence of discovered web applications
> ℹ️
> ℹ️ ***Employees scan***
> ℹ️
> ℹ️ - Map organization's employees data
> ℹ️ - Create a profile for each discovered employee's email
> ℹ️ - Check historical credentials leaks for each email address
> ℹ️ - Map leaks names and dates of each email
> ℹ️ - Locate leaked clear-text passwords for each email
## **Infrastructure**
Clicking on the **“SELECT TEST,”** you will be able to create a **vulnerability assessment scan.**
> ℹ️ ### ***vulnerability assessment scan-Extended data collection process***
> ℹ️
> ℹ️ - Deep enumeration of accessible services of each target
> ℹ️ - Collect screenshot evidence of discovered web application
> ℹ️ - Analyzing implemented technologies
> ℹ️ - Identify CMS applications and launch multiple dedicated scanners
> ℹ️ - Launch multi-step vulnerabilities scanners
** **
By clicking on the name of the URL, it will open a window with the option to** “ADD TEST”**.
You will choose the type of test on this tab, the start date, the time, and if you want it repeatable.
Clicking on the domain name at the Subdomain list and **“ADD TEST,”** you will choose from 2 types of tests- Vulnerability assessment and Hijack checker.
> ℹ️ ### **Vulnerability assessment:**
> ℹ️
> ℹ️ - Deep enumeration of accessible services of each target
> ℹ️ - The scan is running on allidentified open ports
> ℹ️ - Analyzing implemented technologies
> ℹ️ - Runs payloads against the identified systems and technologies
> ℹ️ - Identifies CMS and launch multiple dedicated scanners
> ℹ️ - Launch multi-step vulnerabilities scanners
> ℹ️ ### **Hijack checker**
> ℹ️
> ℹ️ - Checking subdomains for[ subdomain hijacking issues. ](https://kb.cynergy.app/space/MD/899416125)
Clicking on the IP at the **Host list** and **“ADD TEST,”** you will choose from 2 types of tests- Deep scan and Automated exploitation.
> ℹ️ ### **Deep Scan:**
> ℹ️
> ℹ️ - Extended ports and services scans
> ℹ️ - Collect screenshot evidence of discovered services
> ℹ️ - Deep identification process of technologies and versions
> ℹ️ - The system conducts service fingerprinting to identify related versions of services
> ℹ️ - After the version is identified the platform ties the service and versionto related CVEs data and CVSS score
> ℹ️ ### **Automated Exploitation:**
> ℹ️
> ℹ️ - Conducts a Deep Scan as the first step.
> ℹ️ - On the discovered services and CVEs
> ℹ️ - Launches a fully automated process that validates each CVE by exploiting each discovered vulnerability, limited to CISAs known exploitable vulnerabilities for which [Cynergy has a proven and stable auxiliary module](https://kb.cynergy.app/space/MD/904069123/Known+Exploited+Vulnerabilities+-+Identifiable+by+Cynergy) of the following types
> ℹ️ - Binery exploitation
> ℹ️ - Github releases of PoCs
> ℹ️ - Matasploitable modules
> ℹ️ - Collecting evidence of each successful exploitation (CVE) to minimize false-positive and false-negative results
## **Cloud**
you will see your Cloud instances and cloud buckets, and you can sort them out by Exposed only
> ℹ️ **Cloud instances- **A cloud instance is a virtual server instance in a cloud computing environment. It is built, hosted, and delivered using a cloud computing platform and can be accessed remotely.
> ℹ️ **loud buckets- **Buckets are the basic containers that hold your data. Everything that you store in Cloud Storage must be contained in a bucket. You can use buckets to organize your data and control access to your data, but unlike directories and folders, you cannot nest buckets. Because there are limits to bucket creation and deletion, you should design your storage applications to favor intensive object operations and relatively few buckets operations.
## **Employees**
Here you will see the list of your employees, their emails, and their passwords. You also can sort them out and see who has credentials.
You will also be able to create a password spraying scan.
> ℹ️ ### ***Password spraying:***
> ℹ️
> ℹ️ - Collecting relevant employees data (employees profile data and leaked credentials)
> ℹ️ - Mapping for on-premise platforms > OWA, EWS, VPNs
> ℹ️ - Mapping for cloud-based platforms> MSOL (Microsoft Online Services), Office 365, Google Cloud Services (GMAIL, GCP, Etc), Atlassian (BitBucket, Confluence, Jira, Etc), GitHub and GitLab, Okta.