OSINT › Module 6 › Lesson 1
Why Subdomains Matter to Defenders
Forgotten names still get certificates — then inventory a zone YOU own.
Visual · ct_why_subdomains
A subdomain is another hostname under YOUR zone. Original Cyberlium.
Opening
The marketing site is not the whole estate. The forgotten hostname often is.
Defenders lose track of names. A sprint ships staging.api.YOURDOMAIN, a contractor leaves old.YOURDOMAIN on a cheap VPS, a certificate gets issued for both, and nobody updates the inventory spreadsheet. Attackers do not need your org chart. They need a name that still answers. Certificate Transparency and passive collectors make those names public whether you meant them to be or not. This is ORIGINAL Cyberlium Topic 12 — self-OSINT and domains YOU own. as a lab app YOU own.
1. A name is an asset even when nobody bookmarks it
A subdomain is just another DNS name under a zone. If YOU own example-for-literacy vs YOUR real domain, the defender job is the same: list names that still resolve, still have certificates, or still appear in public logs. Forgotten names are not “not production.” They are production you stopped watching.
Cyberlium stays on YOUR zone. Public literacy queries against example.com teach the shape of Certificate Transparency. They are not permission to inventory a bank, a school, or a classmate's side project. Write YOUR in-scope domain from t12-scope.yaml before you point any finder at a name.
Command guide
A name is an asset even when nobody bookmarks it
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/owasp-amass/amass/v4/...@master sudo apt install openssl
Download from https://github.com/Findomain/Findomain/releases
Command — copy this
go install github.com/tomnomnom/assetfinder@latest sudo apt install dnsutils
macOS:
Command — copy this
brew install subfinder brew install amass brew install findomain go install github.com/tomnomnom/assetfinder@latest
Windows:
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/owasp-amass/amass/v4/...@master choco install openssl
Download from https://github.com/Findomain/Findomain/releases
Command — copy this
go install github.com/tomnomnom/assetfinder@latest
Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
test -f "$HOME/cyberlium-lab/t12-scope.yaml" && echo "scope file present"
2. Certificates gossip. DNS sometimes still answers.
When a public certificate is issued, Certificate Transparency logs the names on it. That log is meant to catch mis-issuance. A side effect is a public diary of names someone asked a CA to bind. That is why crt.sh exists. It is not a scanner. It is a search over logs that were published on purpose.
A name in CT might be dead. A name not in CT might still resolve. Defenders correlate: CT, YOUR DNS, YOUR load-balancer configs. Students correlate: notes they own. You do not “confirm” a stranger's staging box with nmap, hydra, or a webcam dork.
3. example.com is a classroom word. YOUR domain is the lab.
Later lessons will curl crt.sh with example.com so you can see JSON-or-browser behavior without pretending you own that zone. Replace the query with a domain from YOUR scope file when you do real inventory. If you do not own a domain, write that honestly and stop. There is no extra credit for picking a famous brand.
. A home router at 192.168.0.1 is not a subdomain lab. Do not nmap 192.168.0.0/24 to “find hidden names.” Subdomains live in DNS and CT, not in a café ARP table.
4. What you ship: a defender sentence about forgotten names
Write: subdomains are hostnames under a zone YOU own; CT publishes names from certificates; forgotten names are inventory debt. and STOP if Router Admin. Notes chmod 600. example.com is literacy only. Bind teaching work to
5. What you record before the next lesson
Date (UTC). Subdomain = extra hostname under YOUR zone. DEMO identified or STOPPED if router. SAFE NEVER mass-enum a stranger corp, nmap the LAN, hydra, or bind 0.0.0.0. Path: $HOME/cyberlium-lab/t12-m06-l01-why-subs.txt. Legal: original Cyberlium — not a recon cert.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Point Amass at a random company “for practice.” nmap 192.168.0.0/24 looking for “hidden hosts.” Treat example.com CT results as a target list to hydra.
Right
with curl. Read t12-scope.yaml. Write why forgotten names matter. Use example.com only as CT literacy. Next: crt.sh and Certificate Transparency.
Mission: name why YOUR forgotten hostnames matter
1) curl http://192.168.0.1/ and decide lab-app vs router (STOP if router). 2) Open t12-scope.yaml and note whether YOU own a domain. 3) Write one sentence: CT can publish names you forgot to inventory. Never mass-enum someone else's corp. Never scan the LAN.
Stuck? Ask Cyberlium AI Mentor
If you have no domain, ask Mentor: “Hint only: how do I practice CT literacy with example.com without treating it as my target?” — not how to enum a brand.
Knowledge Check
APPLY: You do not own a domain. How do you finish this lesson?
Multiple choice
Knowledge Check
APPLY: True or False: A name in Certificate Transparency always still resolves on the internet.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ shows Netgear “Router Admin.” What do you do before any CT query?
Multiple choice