Subdomains the client does not host
The client listed five subdomains as in scope. Resolve each one, find those that are CNAMEs to a SaaS provider, and decide which can be tested without the provider’s permission.
Briefing
Contoso’s authorization lists every subdomain under contoso-shop.example. The rules of engagement add one condition: services hosted by a third party may only be tested under that provider’s own published policy.
dig shows whether a name is a CNAME to someone else’s platform. The client owns the DNS record, not the servers behind it.
pentest-ws · Scope checks
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.