Subdomain Enumeration via CT Logs
osint · easy · +30 XP
Target
GET /api/lab/subdomain-101/ct?domain=... (mock crt.sh — returns historical certs)
GET /api/lab/subdomain-101/probe?host=... (probes a discovered subdomain)
Goal: query CT for acme.io and you'll see ~12 subdomains. One is a forgotten staging host with a debug endpoint exposed. Probe it — the response body is the flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/subdomain-101/
// reuse on the cli
// submit flag
// no solves yet
// start of osint
next
Username Pivoting
1 of 11 · osint