OSINT › Module 6 › Lesson 4
Lab — CT and Subdomain Notes YOU Own
Save a CT literacy result and YOUR zone decision — loopback if you start a toy.
Visual · ct_lab_owned
Lab = notes you own, not a corp enum.
Opening
The grade is an honest file. Empty-because-I-own-nothing beats a stolen inventory.
This lab asks you to keep evidence: GATE result, crt.sh literacy on example.com (or YOUR domain), openssl or skip, finder skip-or-owned-domain, chmod 600. If you start a teaching helper, bind only. You will not nmap a /24, hydra names, or dump a corporation into GitHub. Original Cyberlium. Next: Quiz — Subdomains and CT.
1. GATE, then write the lab header YOU will keep
first. The rest of the lab is files under cyberlium-lab plus optional openssl/crt.sh against literacy or owned names. Official pages remain https://crt.sh/, https://certificate.transparency.dev/, https://github.com/projectdiscovery/subfinder, https://github.com/owasp-amass/amass, assetfinder, findomain, https://www.ssllabs.com/ssltest/.
Create t12-m06-l04-ct-lab.txt as the cover sheet. It should say whether YOU own a domain. Unknown is allowed. Inventing a target is not.
Command guide
GATE, then write the lab header YOU will keep
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/owasp-amass/amass/v4/...@master sudo apt install curl sudo apt install python3
Download from https://github.com/Findomain/Findomain/releases
Command — copy this
go install github.com/tomnomnom/assetfinder@latest
macOS:
Command — copy this
brew install subfinder brew install amass brew install python3 brew install findomain go install github.com/tomnomnom/assetfinder@latest
Windows:
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/owasp-amass/amass/v4/...@master
Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/ Download from https://github.com/Findomain/Findomain/releases
Command — copy this
go install github.com/tomnomnom/assetfinder@latest
═══ COMMANDS ═══
Command — copy this
curl -sS "https://crt.sh/?q=%25.example.com&output=json" | python3 -c "import sys,json; print('ok json' if sys.stdin.read()[:1]=='[' else 'see browser')" | tee "$HOME/cyberlium-lab/t12-m06-l04-crtsh-status.txt"2. Optional local toy on loopback, never 0.0.0.0
If you want a hostname-looking lab page, start a toy bound to in another terminal. curl it. That proves loopback, not a subdomain takeover. Do not publish it on LAN. Do not point SSL Labs at 127.0.0.1 as if it were a production grade.
openssl s_client to example.com remains literacy. openssl to YOUR domain is allowed if you own it. openssl to a stranger is not this lab.
Command guide
Optional local toy on loopback, never 0.0.0.0
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install openssl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install openssl
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t12-m06-toy.py" << 'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
class H(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"cyberlium t12 m06 toy — not a public subdomain")
def log_message(self, fmt, *args):
return
print("start with: python3 this file — binds 127.0.0.1:8805")
HTTPServer(("127.0.0.1", 8805), H).serve_forever()
PY3. Finder decision row, then stop
One row: subfinder/Amass/assetfinder/findomain — not installed / skipped / ran on MY domain. If you ran them, save hostnames YOU own only. Redact anything that is not yours. chmod 600.
Stop. There is no extra credit for a bigger list. Quiz next.
4. What you ship: CT status, openssl-or-skip, finder decision, chmod 600
t12-m06-l04-ct-lab.txt plus crtsh-status and optional openssl note. Toy only on No /24. No stranger SSL Labs. DEMO GATE holds.
5. What you record before the next lesson
Cover sheet path. DEMO identified/STOP. SAFE NEVER mass-enum. Next: Quiz — Subdomains and CT.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Commit a corporation's subdomain dump to GitHub. python http.server --bind 0.0.0.0. hydra names from crt.sh.
Right
Honest notes. Literacy CT. Finders only on YOUR zone or skip. Next: Quiz — Subdomains and CT.
Mission: file YOUR CT and subdomain decisions
1) / STOP if router. 2) Save crt.sh literacy status for example.com (or YOUR domain). 3) Fill finder decision rows; chmod 600. Never nmap. Never enum a corp you do not own. Never bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
If openssl fails in Git Bash, ask Mentor for a PATH hint — not how to scan a /24 “instead.”
Knowledge Check
APPLY: You own nothing on the public DNS. The lab is complete when:
Multiple choice
Knowledge Check
APPLY: True or False: Binding the M6 toy to 0.0.0.0 is required so CT can see it.
True or False
Knowledge Check
APPLY: SSL Labs during this lab:
Multiple choice