find-hidden-subdomains

Find hidden subdomains The hosts an organization forgot about are the ones worth finding, and most of them announced themselves the moment someone requested a TLS certificate. Certificate Transparency turns that into a searchable, permanent, historical index — free and completely passive. The beginner's mistake is treating a CT hit as a live host: most of what you pull back does not resolve, and that is information too, not noise. Which source first You hold Start with Why An apex domain crt.sh wildcard query Broadest free coverage, includes long-dead names A domain behind a wildcard cert Passive DNS, then archives CT will only show you *.example.com A guess at a naming convention CT to learn the convention, then a wordlist Learn the pattern before brute-forcing anything An org name, not a domain Certificate search by subject organization Finds domains you did not know they owned A cert you already have Its SANs, then its serial and issuer SANs give siblings; serial finds the exact cert elsewhere A need for current hosts only Resolve the candidate list CT is historical by nature; DNS is the liveness oracle Show more Installs 975 Repository useosint/osint-skills GitHub Stars 4 First Seen 7 days ago Security Audits Gen Agent Trust Hub Pass Socket Warn Snyk Warn