Recon
Find subdomains recorded in certificate transparency
Pull a domain's subdomains from the crt.sh certificate transparency database.
overview
What certsh-subdomains does
certsh-subdomains is a single-source passive enum step: hand it a domain, get every subdomain crt.sh has logged for that apex.
Use it when you want certificate transparency names without contacting the target. Staging, admin, and other internal-sounding hosts often appear in these logs before DNS scraping finds them.
Merge with subfinder for breadth, dedupe, then probe with httpx. Trickest exposes one domain input and writes file plus folder results.
use cases
Where certsh-subdomains fits
Enumerate subdomains passively
Query crt.sh for a domain to list the subdomains certificate transparency has recorded, without sending any traffic to the target.
Surface internal-sounding hosts
Certificate logs often capture staging, admin, webmail, and other internal names that DNS scraping misses, giving you leads worth probing first.
Seed an attack-surface workflow
Use certsh-subdomains as a starting enumeration source, then pass its names to httpx so probing runs against the discovered footprint.
Broaden coverage by merging sources
Combine its crt.sh results with subfinder or amass and dedupe, since each source sees names the others do not.
reference
certsh-subdomains inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to enumerate. certsh-subdomains queries crt.sh for every subdomain seen in that domain's certificates. |
Showing key inputs. certsh-subdomains exposes 1 inputs in total.
example
Run certsh-subdomains
# pull a domain's subdomains from crt.sh, one name per linecertsh-subdomains example.com*.example.comexample.comapi.example.comautodiscover.example.comcpanel.example.comdev.example.commail.example.comstaging.example.comvpn.example.comwebmail.example.comguidance
Choosing certsh-subdomains
Use certsh-subdomains at the start of recon for fast, passive subdomain discovery from certificate transparency. It reads crt.sh, not the target. It finds names; it does not test them. Merge with subfinder, then follow with httpx.
subfinder
Queries many passive sources including crt.sh. certsh-subdomains is the focused, crt.sh-only finder.
cero
Reads certificate names off live hosts over TLS. certsh-subdomains reads the same kind of data from public logs.
amass
Deeper multi-source enumeration with active options. certsh-subdomains is a single, quick certificate-log source.
faq
certsh-subdomains questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run certsh-subdomains yourself
A domain feeds certsh-subdomains, which pulls its subdomains from the crt.sh log and hands them to httpx so only the live names land as a queryable output.
Facts on this page come from the live Trickest tool library.