Lion Cipher Lab
Read Amass output: map an org's attack surface and spot the assets nobody remembers
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Running a recon tool is the easy half. Anyone can paste a domain after `amass enum` and watch names scroll past. The half that pays is what happens next: someone hands you three hundred discovered hostnames and asks 'so what does this tell us?' A tool prints a list; a person reads an attack surface. Buried in that list — every single time, on every real organisation — are the things nobody remembers owning: the staging box from a project that shipped in 2019, the marketing subdomain still pointing at a SaaS trial that lapsed, the analytics server a data scientist spun up in a cloud account…
What you'll learn
- reading a single Amass result line: name -> resolved IP (or CNAME) -> ASN/netblock -> data source
- grouping discovered assets by owner/ASN to separate self-hosted from third-party infrastructure
- spotting a forgotten dev/staging host and knowing why it is a high-value, low-attention target
- recognising a dangling CNAME to a deprovisioned SaaS resource as a subdomain-takeover candidate
- flagging assets in an unexpected cloud/ASN as shadow IT
- recognising DNS wildcard artifacts so you do not chase phantom hosts
- turning a flat list of names into a triage: what we own, what is exposed, what to investigate first
- judgment: when passive recon output IS the finding, and when you must probe further before believing it
Steps in this lab
- The scenario, and the data you are here to read
- How to read ONE line: name, resolution, owner, source
- Group by owner: separate what you host from what a third party hosts
- Finding #1 — the forgotten staging/dev host nobody remembers
- Finding #2 — the dangling CNAME: a subdomain-takeover waiting to happen
- Finding #3 — the wildcard artifact: three phantom hosts, one IP
- Finding #4 — the shadow-IT asset in a cloud nobody claims
- WHEN the output IS the finding — and WHEN you must probe further
- Turn the list into a triage: what we own, what's exposed, what to investigate first
- Do it better — the habits that separate a reader from a lister