TL;DR: site:, inurl:, intitle:, ext: operators against target apex + acquisitions to surface forgotten subdomains and exposed files.
Stub — to be filled in.
What it is
TODO
Preconditions / where it applies
TODO
Technique
TODO
Detection and defence
TODO
References