I am a junior pentester currently working for a secure messaging app that includes a webclient. Only the subdomain is in scope and other subdomains are off-limits. Social engineering is also off limits as this is a staging server that mimics the live server and is only used for pentesting purposes.
I tried using nmap to scan for info gathering, but the returned results aren't much and even Nessus returns "invalid path".
I also tried to use burp suite to intercept but it seems that there is some sort of blocking (probably ssl pinning) that when using an intercepting proxy, the login field is hidden. I proceed to login without proxy and tried proxy to burp again, but the traffic seems to be halted and most of the stuff does not load.
I also tried using shodan and wappanalyzer but so far I can only acquire info on some older version web components that do not seem to have any vulnerabilities.
Nikto was used in an effort to identify common web vulnerabilities but not many results were returned.
Any advice futher reconnaissance would be much appreciated.