Scanning
We run nmap on all ports with scripts and software versions.
Enumeration
We access the web site and find the domain (we put it in our /etc/hosts file).
It also tells us about a photo editing application, but we can't find any link to it, so it's probably on another subdomain.
