loading
Loading content
loading
Recon
Scrape domain names from SSL certificates of arbitrary hosts.
overview
cero sits after a host or IP list and before probing. It opens TLS to each target and emits the CN and SAN names the certificate returns.
Reach for it when a port scan or netblock left you addresses, and passive finders still miss related domains those certs advertise.
Feed a targets file; set -p for non-443 ports, -c and -t for sweep pace, -d to strip IPs and wildcards. Merge with subfinder, then probe with httpx. Trickest runs it as a managed Recon node with file and folder output.
source github.com/glebarez/cero
use cases
Read the common name and SANs off live TLS certificates to surface related domains and subdomains that passive subdomain sources do not list.
Sweep an IP range and pull certificate domains from every TLS-listening host, turning raw address space into a list of owned names.
Point cero at custom ports with -p so certificates served on services beyond 443 still contribute their domain names to the scope.
Enable -d filtered output to drop IPs, wildcards, and gibberish so the domains that flow into enumeration and probing are valid names.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | File of target hosts or IPs to read certificates from. |
| ports | STRING | -p | TLS ports to use when not specified in the host address (default 443). |
| concurrency | STRING | -c | Concurrency level (default 100). |
| tls-timeout | STRING | -t | TLS connection timeout in seconds (default 4). |
| filter-output | BOOLEAN | -d | Output only valid domain names (strip IPs, wildcards, and gibberish). |
| verbose | BOOLEAN | -v | Verbose output with per-address results and errors. |
Showing key inputs. cero exposes 6 inputs in total.
example
# scrape cert domains from hosts, keep only valid namescero -p 443,8443 -c 50 -t 4 -d < hosts.txtwww.example.comapi.example.commail.example.comstaging.example.comdev.example.comportal.example.comcdn.example.comvpn.example.comguidance
Use cero when you have hosts or IPs to connect to and need domain names from live TLS certificates. Passive sources like certsh-subdomains and subfinder need no handshake; cero does. Merge names, then probe with httpx.
Broad TLS data collection including certificate fields. cero scrapes domain names only.
Passive subdomain discovery from many sources. cero adds names pulled from live certificates.
Reads names from crt.sh certificate logs. cero reads certificates off the live hosts instead.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A target list feeds cero, which scrapes domain names from each host's TLS certificate and hands them to httpx so the live ones land as a queryable output.
Facts on this page come from the live Trickest tool library.