DNS Recon Playground
A simulated dig. Query a target's likely subdomains and build a map of its real, sometimes-forgotten attack surface.
A simulated dig. Query a target's likely subdomains and assemble the map — including the staging box, the old admin panel and the forgotten service that nobody has patched since it stopped being important.
How to use it
- Query the obvious names.
- Work through common subdomain patterns.
- Assemble the picture of what is actually exposed.
What to take away
Forgotten hosts are the valuable ones
dev, staging, old and test frequently run outdated software with weaker controls and real data.
Record types answer different questions
A and AAAA give addresses, MX gives mail infrastructure, TXT often leaks vendor relationships through verification records, CNAME reveals third-party hosting.
Certificate transparency is a free subdomain list
Every issued certificate is logged publicly, so requesting one for a private hostname publishes its name.
Frequently asked questions
Is DNS enumeration legal?
Querying public DNS is public information lookup. Connecting to what you find is a separate question requiring authorisation.
How do defenders reduce DNS exposure?
Keep an authoritative inventory, remove records when services are decommissioned, avoid descriptive internal names in public zones, and monitor certificate transparency for your own domains.
Where this fits in the course
This security lab pairs with Path 14 — Ethical Hacking — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Subdomain Takeover Simulator — Five DNS records, one dangling CNAME pointing at a deleted third-party resource. Find it before someone else claims it.
- OSINT Sandbox — A safe, fake company profile — practise open-source recon technique without touching anything real.
- Packet Capture Viewer — Load a sample capture and explore protocols, IPs, and payloads — the same "read the traffic" muscle Wireshark builds.
- Subnet Calculator — IPv4 CIDR → network, broadcast, host range, mask, and host count.