OSINT › Module 6 › Lesson 4
Lab — CT and Subdomain Notes YOU Own
Save a CT literacy result and YOUR zone decision — loopback if you start a toy.
Visual · ct_lab_owned
Lab = notes you own, not a corp enum.
Opening
The grade is an honest file. Empty-because-I-own-nothing beats a stolen inventory.
This lab asks you to keep evidence: GATE result, crt.sh literacy on example.com (or YOUR domain), openssl or skip, finder skip-or-owned-domain, chmod 600. If you start a teaching helper, bind only. You will not nmap a /24, hydra names, or dump a corporation into GitHub. Original Cyberlium. Next: Quiz — Subdomains and CT.
1. GATE, then write the lab header YOU will keep
first. The rest of the lab is files under cyberlium-lab plus optional openssl/crt.sh against literacy or owned names. Official pages remain https://crt.sh/, https://certificate.transparency.dev/, https://github.com/projectdiscovery/subfinder, https://github.com/owasp-amass/amass, assetfinder, findomain, https://www.ssllabs.com/ssltest/.
Create t12-m06-l04-ct-lab.txt as the cover sheet. It should say whether YOU own a domain. Unknown is allowed. Inventing a target is not.
Command guide
GATE, then write the lab header YOU will keep
═══ LINUX / macOS (Web & API Security Testing) ═══
Test HTTP methods on authorized lab endpoint
Command — copy this
for method in GET POST PUT DELETE OPTIONS; do
curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
doneTest JSON API with Authorization Bearer header
Command — copy this
curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <TEST_TOKEN>" \
-d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || catCheck for CORS misconfiguration headers
Command — copy this
curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"2. Optional local toy on loopback, never 0.0.0.0
If you want a hostname-looking lab page, start a toy bound to in another terminal. curl it. That proves loopback, not a subdomain takeover. Do not publish it on LAN. Do not point SSL Labs at 127.0.0.1 as if it were a production grade.
openssl s_client to example.com remains literacy. openssl to YOUR domain is allowed if you own it. openssl to a stranger is not this lab.
Command guide
Optional local toy on loopback, never 0.0.0.0
═══ LINUX / macOS (Web & API Security Testing) ═══
Test HTTP methods on authorized lab endpoint
Command — copy this
for method in GET POST PUT DELETE OPTIONS; do
curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
doneTest JSON API with Authorization Bearer header
Command — copy this
curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <TEST_TOKEN>" \
-d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || catCheck for CORS misconfiguration headers
Command — copy this
curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"3. Finder decision row, then stop
One row: subfinder/Amass/assetfinder/findomain — not installed / skipped / ran on MY domain. If you ran them, save hostnames YOU own only. Redact anything that is not yours. chmod 600.
Stop. There is no extra credit for a bigger list. Quiz next.
4. What you ship: CT status, openssl-or-skip, finder decision, chmod 600
t12-m06-l04-ct-lab.txt plus crtsh-status and optional openssl note. Toy only on No /24. No stranger SSL Labs. DEMO GATE holds.
5. What you record before the next lesson
Cover sheet path. DEMO identified/STOP. SAFE NEVER mass-enum. Next: Quiz — Subdomains and CT.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Commit a corporation's subdomain dump to GitHub. python http.server --bind 0.0.0.0. hydra names from crt.sh.
Right
Honest notes. Literacy CT. Finders only on YOUR zone or skip. Next: Quiz — Subdomains and CT.
Mission: file YOUR CT and subdomain decisions
1) / STOP if router. 2) Save crt.sh literacy status for example.com (or YOUR domain). 3) Fill finder decision rows; chmod 600. Never nmap. Never enum a corp you do not own. Never bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
If openssl fails in Git Bash, ask Mentor for a PATH hint — not how to scan a /24 “instead.”
Knowledge Check
APPLY: You own nothing on the public DNS. The lab is complete when:
Multiple choice
Knowledge Check
APPLY: True or False: Binding the M6 toy to 0.0.0.0 is required so CT can see it.
True or False
Knowledge Check
APPLY: SSL Labs during this lab:
Multiple choice