Capture the FlagMedium
The Subdomain They Forgot
Lab for Subdomain Enumeration: Passive & Active Recon
Scenario
Passive subdomain sources only know about names that have leaked publicly. The interesting one here never did, you'll have to brute-force DNS to surface it, then browse to it.
Objective
Brute-force DNS to find a subdomain passive tools miss, then read it.
lab ~ the subdomain they forgotnothing real runs
booting lab sandbox…
This sandbox is fully emulated in your browser, nothing real runs and nothing leaves your machine. Type help to see the tools available.