• Small Scope

Only Specific URLs are part of Scope. This usually includes staging/dev/testing or single URLs.

•  Directory Enumeration
•  Technology Fingerprinting
•  Port Scanning
•  Parameter Fuzzing
•  Wayback History
•  Known Vulnerabilities
•  Hardcoded Information in JavaScript
•  Domain Specific GitHub & Google Dorking
•  Broken Link Hijacking
•  Data Breach Analysis
•  Misconfigured Cloud Storage

• Medium Scope

Usually the scope is wild card scope where all the subdomains are part of scope

•  Subdomain Enumeration
•  Subdomain Takeover
•  Probing & Technology Fingerprinting
•  Port Scanning
•  Known Vulnerabilities
•  Template Based Scanning (Nuclei/Jeales)
•  Misconfigured Cloud Storage
•  Broken Link Hijacking
•  Directory Enumeration
•  Hardcoded Information in JavaScript
•  GitHub Reconnaissance
•  Google Dorking
•  Data Breach Analysis
•  Parameter Fuzzing
•  Internet Search Engine Discovery (Shodan, Censys, Spyse, etc.)
•  IP Range Enumeration (If in Scope)
•  Wayback History
•  Potential Pattern Extraction with GF and automating further for XSS, SSRF, etc.
•  Heartbleed Scanning
•  General Security Misconfiguration Scanning

• Large Scope

Everything related to the Organization is a part of Scope. This includes child companies, subdomains or any labelled asset owned by organization.

•  Tracking & Tracing every possible signatures of the Target Application (Often there might not be any history on Google related to a scope target, but you can still crawl it.) ​
•  Subsidiary & Acquisition Enumeration (Depth – Max)​
•  Reverse Lookup
•  ASN & IP Space Enumeration and Service Identification​
•  Subdomain Enumeration
•  Subdomain Takeover
•  Probing & Technology Fingerprinting
•  Port Scanning
•  Known Vulnerabilities
•  Template Based Scanning (Nuclei/Jeales)
•  Misconfigured Cloud Storage
•  Broken Link Hijacking
•  Directory Enumeration
•  Hardcoded Information in JavaScript
•  GitHub Reconnaissance
•  Google Dorking
•  Data Breach Analysis
•  Parameter Fuzzing
•  Internet Search Engine Discovery (Shodan, Censys, Spyse, etc.)
•  IP Range Enumeration (If in Scope)
•  Wayback History
•  Potential Pattern Extraction with GF and automating further for XSS, SSRF, etc.
•  Heartbleed Scanning
•  General Security Misconfiguration Scanning
•  And any possible Recon Vector (Network/Web) can be applied.​

Source: Link