Generally, when we put a domain name in the DNS, this domain will be resolved by the public DNS servers, such as 8.8.8.8. This means that even people outside the network can get a glimpse of what kind of software and applications are being used internally.
Let's look at the following screenshot to understand this. In the following image, we see that there are five subdomains for the record of internal.kplabs.in.
These subdomains are as follows:
- admin.internal.kplabs.in
- elk.nternal.kplabs.in
- phpmyadmin.internal.kplabs.in
- mongodb.internal.kplabs.in
- ipa.internal.kplabs.in
If an outsider looks into these subdomains, they can quickly map into what type of technologies are being used by an organization. From the following sample record sets, we can see that the organization is using various technologies such as PhpMyAdmin, MongoDB, ELK...
