domain-intel

Passive domain reconnaissance can be performed using only the Python standard library to gather subdomains, SSL data, WHOIS records, and DNS resolutions without external APIs. It uses stdlib modules like socket, ssl, and urllib to query public sources such as Certificate Transparency logs.

You can discover subdomains using Certificate Transparency logs via crt.sh with Python. The tool queries crt.sh using standard library HTTP requests to passively collect subdomains without needing dedicated API keys or paid services.

Checking SSL certificate expiry and issuer details is done by inspecting the target domain's SSL certificate. The tool uses Python's built-in ssl module to extract certificate metadata including expiration dates, issuer information, and Subject Alternative Names (SANs).

Bulk analysis for multiple domains is supported with concurrent requests. You can process domain lists to gather DNS records, WHOIS data, and subdomains concurrently, outputting the aggregated results as structured JSON for automation.

Resolving DNS records like A, MX, and TXT without third-party libraries is achieved via DNS over HTTPS (DoH) and system DNS. The tool leverages Python's standard library to query and return A, AAAA, MX, NS, TXT, and CNAME records.

Using Python stdlib for WHOIS lookups limits queries to common TLDs due to varying regional registry formats. While it avoids external dependencies, WHOIS parsing across less common TLDs may lack consistency compared to dedicated WHOIS libraries.