Appendix I — DNS, Subdomains, and Safe Fixture Requests Answers

Completed Check

The fixture request behaves enough like requests.get() for this lesson, but it never contacts the public internet. That gives you the shape of a reconnaissance tool without accidentally turning practice into traffic against somebody else’s system.

import requests

from fixtures.local_targets import fake_requests_get


def check_subdomain(label: str, domain: str) -> bool:
    url = f"https://{label}.{domain}"
    try:
        response = fake_requests_get(url, timeout=2)
    except requests.exceptions.ConnectionError:
        return False
    return response.status_code == 200


print(check_subdomain("www", "example.test"))
print(check_subdomain("missing", "example.test"))

True
False

For the extension, returning the hostname can make final output more useful than a bare boolean. The same safety boundary still applies: build the fixture URL, handle expected misses, and only report hosts the fixture knows about.

def find_subdomain(label: str, domain: str) -> str | None:
    hostname = f"{label}.{domain}"
    url = f"https://{hostname}"
    try:
        response = fake_requests_get(url, timeout=2)
    except requests.exceptions.ConnectionError:
        return None
    if response.status_code == 200:
        return hostname
    return None


print(find_subdomain("www", "example.test"))
print(find_subdomain("missing", "example.test"))

www.example.test
None

References: RFC 1034, RFC 1035, RFC 5737, and Requests Documentation.