In so many penetration tests or assessments, the client gives you a set of subnets and says "go for it".  This all seems reasonable, until you realize that if you have a website, there might be dozens or hundreds of websites hosted there, each only accessible by their DNS name.

In those situations, browsing just by IP might give you a default page the developer wrote, or even worse, the default Apache or IIS page.  Needless to say, without that list of DNS names, your assessment will be less than complete!

So, how do we get those website names?  The first go-to will be the certificate - nmap can give you DNS names in the CN (Common Name) and SAN (Subject Alternative Names) fields of the certificate.

What are these flags?

is the list of ports - that's 443 for ...