Recon
Pull related domains from live TLS certificates
Scrape domain names from SSL certificates of arbitrary hosts.
overview
What cero does
cero sits after a host or IP list and before probing. It opens TLS to each target and emits the CN and SAN names the certificate returns.
Reach for it when a port scan or netblock left you addresses, and passive finders still miss related domains those certs advertise.
Feed a targets file; set -p for non-443 ports, -c and -t for sweep pace, -d to strip IPs and wildcards. Merge with subfinder, then probe with httpx. Trickest runs it as a managed Recon node with file and folder output.
source github.com/glebarez/cero
use cases
Where cero fits
Expand scope from certificate names
Read the common name and SANs off live TLS certificates to surface related domains and subdomains that passive subdomain sources do not list.
Harvest names across a netblock
Sweep an IP range and pull certificate domains from every TLS-listening host, turning raw address space into a list of owned names.
Mine nonstandard TLS ports
Point cero at custom ports with -p so certificates served on services beyond 443 still contribute their domain names to the scope.
Keep output clean for the next stage
Enable -d filtered output to drop IPs, wildcards, and gibberish so the domains that flow into enumeration and probing are valid names.
reference
cero inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | File of target hosts or IPs to read certificates from. |
| ports | STRING | -p | TLS ports to use when not specified in the host address (default 443). |
| concurrency | STRING | -c | Concurrency level (default 100). |
| tls-timeout | STRING | -t | TLS connection timeout in seconds (default 4). |
| filter-output | BOOLEAN | -d | Output only valid domain names (strip IPs, wildcards, and gibberish). |
| verbose | BOOLEAN | -v | Verbose output with per-address results and errors. |
Showing key inputs. cero exposes 6 inputs in total.
example
Run cero
# scrape cert domains from hosts, keep only valid namescero -p 443,8443 -c 50 -t 4 -d < hosts.txtwww.example.comapi.example.commail.example.comstaging.example.comdev.example.comportal.example.comcdn.example.comvpn.example.comguidance
Choosing cero
Use cero when you have hosts or IPs to connect to and need domain names from live TLS certificates. Passive sources like certsh-subdomains and subfinder need no handshake; cero does. Merge names, then probe with httpx.
tlsx
Broad TLS data collection including certificate fields. cero scrapes domain names only.
subfinder
Passive subdomain discovery from many sources. cero adds names pulled from live certificates.
certsh-subdomains
Reads names from crt.sh certificate logs. cero reads certificates off the live hosts instead.
faq
cero questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run cero yourself
A target list feeds cero, which scrapes domain names from each host's TLS certificate and hands them to httpx so the live ones land as a queryable output.
Facts on this page come from the live Trickest tool library.