Viktor Petrov

I start on my own domains. Running a subdomain sweep against something I control tells me what the internet sees, which is usually not what the inventory document claims, and it fills me with better examples than a theoretical walkthrough ever would. Subdomain discovery has three reliable sources and a long tail. Certificate transparency logs publish the names a certificate authority has issued for, which catches internal naming conventions nobody documented. DNS brute force against a wordlist finds hosts with no certificate. Crawling and guessing application names finds the rest. All three drown in noise: wildcard DNS returns the same address for every name, so a naive scanner reports thousands of hosts that do not exist. Status codes are the useful signal. 200 means the host serves content. 301 and 302 mean it exists and redirects somewhere. 403 means the host is there and refusing, which is the answer people most often discard as a failure. 404 is the only real absence, and even that can come from a catch-all server. Redirect chains hide more than they reveal. A login page three hops away may have been folded into a new marketing site. An infinite loop usually means a misconfigured host. I follow them and report the full chain, because a single hop hides most of the story. Technology fingerprinting reads headers and generator tags, some honest and some stripped by every current framework. Where a fingerprint comes from a marker file or an error page, I say so, since those are stronger signals. I am consistent about authorisation. Every page states what a request target is and what rate limits apply, because these tools work equally well against a host that has not agreed to it.