Fingerprint web apps. Gather intel on server & client-side technologies. Scan multiple virtual hosts on the same IP. Do passive reconnaissance. Map attack surface.