Lion Cipher Lab
Collect passive OSINT on a domain you own
- Threat Intel Analyst
- Beginner
- ~50 min
- Free · no account required
Why it matters
Before an attacker sends a single packet at a target, they read. They look up who registered the domain, what mail and web servers it points to, what other services and forgotten test sites hang off it — all from public records, without ever touching the target, which means the target never even knows they are being studied. That quiet reading phase is called passive reconnaissance, and it is the very first move in almost every real intrusion. The good news: those same public records are open to YOU about your OWN domain, and looking at them is the fastest way to understand your 'attack…
What you'll learn
- telling passive OSINT (reading public records) apart from active recon (probing a target) — and why the line matters legally
- reading a domain's WHOIS registration record and knowing what it exposes
- querying DNS records (A, MX, TXT, NS) with dig, nslookup, or a free online tool
- using certificate transparency logs at crt.sh to discover subdomains for free
- assembling what you find into a plain 'attack surface' map of a domain
- reducing your own public footprint: what to hide, retire, or lock down once you can see it
Steps in this lab
- The words first: OSINT, passive vs active, attack surface, footprint
- The one rule that keeps this legal and safe
- What you are about to read: DNS, the internet's phone book
- First lookup: WHOIS — who registered the domain
- Pull the DNS records with dig (or nslookup, or a web tool)
- Certificate transparency: free subdomains from crt.sh
- Public subdomain discovery: finding the forgotten doors
- Assemble it: your domain's attack-surface map
- Now shrink it: defensive footprint reduction
- Why this reflex is worth building