Attack Surface: The Subdomains You Forgot You Had

Every security audit starts the same way: "Show me all your public-facing assets." And every organization gives the same answer: a list that's incomplete. They know about www. They know about mail. They know about api. But what about dev.yourcompany....