cert-transparency

Subdomain discovery through certificate transparency logs involves querying public CT log APIs to surface domains associated with issued TLS certificates. This skill queries crt.sh to fetch and deduplicate subdomain records for a target domain, outputting a clean attack surface list.

Passive reconnaissance gathers target infrastructure data without actively probing the network, relying on third-party sources. Certificate transparency lookups are needed for domain auditing and inventorying TLS assets, uncovering subdomains and certificates not visible through DNS queries alone.

Enumerating subdomains from crt.sh involves querying its API and parsing JSON responses to extract Common Name and Subject Alternative Name fields. This skill processes the API output, deduplicates results, and surfaces a clean list of discovered subdomains and certificate data.

Yes, curl and jq are required dependencies to query certificate transparency logs via this skill. Curl fetches data from the crt.sh API endpoint while jq parses and extracts the relevant CN and SAN fields from the JSON response for subdomain enumeration.

Certificate transparency logs are effective for discovering publicly certified subdomains but have limitations uncovering internal infrastructure. CT logs only contain entries for certificates issued by public CAs, so internal subdomains with private or self-signed certificates will not appear in crt.sh query results.

Inventorying TLS assets is best done by aggregating issued certificate records from public transparency logs. This skill queries crt.sh to surface all certificates and subdomains for a target domain, providing a deduplicated view for risk assessment and supplementing other recon sources.