A transit booking app's DNS reveals staging and admin subdomains. Why is subdomain enumeration core web recon?
Select an answer to reveal the explanation.
Short Explanation
Staging and admin subdomains are the side buildings behind the polished storefront. They often have weaker locks and older apps. If scope includes them, map them — that is where many real findings hide.
Full Explanation
Subdomain enumeration is core web recon for a transit booking app because subdomains often host weaker staging or admin applications that expand attack surface when included in scope. Subdomains are not cosmetic marketing labels without security value. Staging and admin hosts should not be ignored by default; if DNS reveals them, confirm whether scope covers them before testing. Subdomain mapping is for penetration testing, not only trademark disputes. Exam caveat: out-of-scope third-party SaaS subdomains need client confirmation before intrusive tests. Operational check: enumerate DNS names, classify staging/admin/prod, verify scope inclusion with transit stakeholders, and prioritize weaker staging or admin apps for authorized deeper review. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.