HackBlue

Tools · Ethical OSINT and privacy self-defense · 04 / 17

Finding your subdomains through certificate transparency logs with crt.sh

Query certificate transparency logs for every certificate issued for your domain, extract subdomain names, check which still resolve, and spot forgotten or unexpected hosts.

9 min read · practice only with authorization

Why CT logs reveal hosts

Publicly trusted certificate authorities must log every certificate they issue in certificate transparency (CT) logs. Each certificate lists names in its SAN field, so the logs form a public history of hostnames your organization has secured. That is useful for defenders building an asset inventory and is something attackers check too.

Querying

crt.sh offers a web interface and JSON output. A wildcard query %.example.org returns certificates for all subdomains. Deduplicate names, strip wildcards, and resolve them.

Snippet
curl -s 'https://crt.sh/?q=%25.example.org&output=json' \
  | jq -r '.[].name_value' | tr 'A-Z' 'a-z' | sed 's/^\*\.//' | sort -u > ct-names.txt
wc -l ct-names.txt
while read -r h; do
  ip=$(dig +short "$h" A | head -1)
  printf '%s\t%s\n' "$h" "${ip:-NXDOMAIN}"
done < ct-names.txt > resolved.tsv

Lab: inventory your own domain

Run the query for your own domain or one you are authorized to assess. Compare the list with your known asset inventory. Mark hosts that resolve but are not in the inventory, hosts that no longer resolve (old projects), and names that reveal internal details such as vpn, jira, or staging. For live unknown hosts, find an owner and decide whether they should exist.

Notes and limits

Wildcard certificates hide individual names, internal names using private CAs never appear, and CT shows certificates, not whether a host is still in use. Combine CT with DNS records and your cloud inventories. Monitoring services can alert you when a new certificate is issued for your domain, which also catches unauthorized issuance.

Diagram

CT-based subdomain inventory

  1. Query

    crt.sh for %.yourdomain with JSON output.

  2. Normalize

    Lowercase, strip wildcards, deduplicate.

  3. Resolve

    Check which names still resolve and where.

  4. Compare

    Match against your inventory; assign owners to unknowns.

Check yourself

1. Why do CT logs reveal subdomains?

2. Which finding most needs follow-up?

3. What can CT logs not show?