loading
Loading content
loading
Recon
Pull a domain's subdomains from the crt.sh certificate transparency database.
overview
certsh-subdomains is a single-source passive enum step: hand it a domain, get every subdomain crt.sh has logged for that apex.
Use it when you want certificate transparency names without contacting the target. Staging, admin, and other internal-sounding hosts often appear in these logs before DNS scraping finds them.
Merge with subfinder for breadth, dedupe, then probe with httpx. Trickest exposes one domain input and writes file plus folder results.
use cases
Query crt.sh for a domain to list the subdomains certificate transparency has recorded, without sending any traffic to the target.
Certificate logs often capture staging, admin, webmail, and other internal names that DNS scraping misses, giving you leads worth probing first.
Use certsh-subdomains as a starting enumeration source, then pass its names to httpx so probing runs against the discovered footprint.
Combine its crt.sh results with subfinder or amass and dedupe, since each source sees names the others do not.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to enumerate. certsh-subdomains queries crt.sh for every subdomain seen in that domain's certificates. |
Showing key inputs. certsh-subdomains exposes 1 inputs in total.
example
# pull a domain's subdomains from crt.sh, one name per linecertsh-subdomains example.com*.example.comexample.comapi.example.comautodiscover.example.comcpanel.example.comdev.example.commail.example.comstaging.example.comvpn.example.comwebmail.example.comguidance
Use certsh-subdomains at the start of recon for fast, passive subdomain discovery from certificate transparency. It reads crt.sh, not the target. It finds names; it does not test them. Merge with subfinder, then follow with httpx.
Queries many passive sources including crt.sh. certsh-subdomains is the focused, crt.sh-only finder.
Reads certificate names off live hosts over TLS. certsh-subdomains reads the same kind of data from public logs.
Deeper multi-source enumeration with active options. certsh-subdomains is a single, quick certificate-log source.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds certsh-subdomains, which pulls its subdomains from the crt.sh log and hands them to httpx so only the live names land as a queryable output.
Facts on this page come from the live Trickest tool library.