A transit booking app's DNS reveals staging and admin subdomains. Why is subdomain enumeration core web recon?
Select an answer to reveal the explanation.
Short Explanation
Staging and admin subdomains are the side buildings behind the polished storefront. They often have weaker locks and older apps. If scope includes them, map them — that is where many real findings hide.
Full Explanation
Subdomain enumeration expands the known web asset inventory beyond the primary hostname. Staging, legacy, and admin-related names frequently present weaker controls or richer functionality. When those names fall inside authorized scope, they are high-value recon targets. Treating subdomains as merely cosmetic or automatically out of scope understates common engagement reality.