Skip to content
HackIndex logo

HackIndex

Certificate Transparency Enumeration

4 min read Jul 10, 2026

Certificate transparency logs record every TLS certificate issued by public CAs. Every subdomain that has ever had a certificate is visible — including internal hostnames, staging environments, and short-lived test domains. CT enumeration is passive, generates no target traffic, and often surfaces subdomains that wordlist bruteforce misses entirely.

Feed results into subdomain bruteforce as seed names and into virtual host enumeration when multiple names resolve to the same IP.

crt.sh Query

crt.sh is the fastest CT log search. Query it via the API for a domain and get all certificates including wildcards and subdomains:

┌──(kali㉿kali)-[~]
└─$ curl -sk "https://crt.sh/?q=%25.$DOMAIN&output=json" | python3 -c "import sys,json; data=json.load(sys.stdin); [print(e['name_value']) for e in data]" | sort -u 
dev.example.com
api.example.com
staging.example.com
*.internal.example.com
mail.example.com
Explain command
-s Silent mode; suppresses progress and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
https://crt.sh/?q=%25.$DOMAIN&output=json Target URL querying crt.sh for wildcard subdomains of $DOMAIN in JSON format.
$DOMAIN Placeholder for the target domain to search certificate transparency logs.
-u Passed to sort; outputs only unique lines, removing duplicates.

The %25. prefix is a SQL LIKE wildcard that matches all subdomains. Wildcard certificates (*.example.com) confirm wildcard DNS is likely in use. Internal-looking names like internal, corp, intranet, or dev are high-priority targets for virtual host enumeration.

Clean the output to a simple hostname list:

┌──(kali㉿kali)-[~]
└─$ curl -sk "https://crt.sh/?q=%25.$DOMAIN&output=json" | python3 -c "import sys,json; data=json.load(sys.stdin); [print(e['name_value'].replace('*.','')) for e in data]" | grep -v '@' | sort -u > ct_subdomains.txt && wc -l ct_subdomains.txt 
47 ct_subdomains.txt
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
https://crt.sh/?q=%25.$DOMAIN&output=json Target URL querying crt.sh CT logs for subdomains of $DOMAIN in JSON format.
$DOMAIN Variable placeholder for the target domain to enumerate subdomains for.
-v Inverts grep match; excludes lines containing '@' (email addresses).
-u Outputs only unique lines after sorting.

amass Passive CT Enumeration

amass queries multiple CT log sources and passive DNS databases simultaneously. Slower than crt.sh but more comprehensive:

┌──(kali㉿kali)-[~]
└─$ amass enum -passive -d $DOMAIN -o amass_ct.txt
Explain command
enum Subcommand to perform subdomain enumeration.
-passive Use only passive techniques; no direct interaction with target.
-d $DOMAIN Target domain to enumerate subdomains for.
-o amass_ct.txt Write discovered subdomains/results to specified output file.
┌──(kali㉿kali)-[~]
└─$ amass enum -passive -d $DOMAIN -src -o amass_ct_sources.txt 
CertSpotter  dev.example.com
crt.sh       api.example.com
DNSDB        staging.example.com
Explain command
enum Subcommand to perform DNS enumeration.
-passive Use only passive data sources, no active probing.
-d $DOMAIN Target domain to enumerate subdomains for.
-src Display the data source for each discovered name.
-o amass_ct_sources.txt Write enumeration output to the specified file.

The -src flag shows which source found each hostname. Subdomains found only in CT logs but not in DNS often indicate decommissioned infrastructure that may still be reachable.

Extract SANs from Live Certificates

When you already have an IP or hostname, pull the live certificate and extract all Subject Alternative Names. These often reveal additional hostnames not in DNS:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $DOMAIN:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName 
X509v3 Subject Alternative Name:
    DNS:example.com, DNS:www.example.com, DNS:api.example.com, DNS:internal.corp.example.com
Explain command
-connect $DOMAIN:443 Specifies the host and port to establish the TLS connection.
-servername $DOMAIN Sets the SNI hostname sent in the TLS ClientHello.
</dev/null Redirects stdin from null device to prevent interactive blocking.
2>/dev/null Suppresses stderr output by redirecting it to null device.
-noout Prevents outputting the encoded certificate data.
-ext subjectAltName Prints only the subjectAltName extension from the certificate.
┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName | grep -oP '(?<=DNS:)[^,]+' 
example.com
www.example.com
api.example.com
internal.corp.example.com
Explain command
-connect $TARGET_IP:443 Specifies the target host and port to establish the TLS connection.
-servername $DOMAIN Sets the SNI hostname sent in the TLS ClientHello for virtual hosting.
</dev/null Feeds empty input to prevent s_client from waiting on stdin.
2>/dev/null Suppresses stderr output to discard connection noise/errors.
-noout Suppresses printing of the encoded certificate data.
-ext subjectAltName Extracts and displays only the subjectAltName certificate extension.
-oP '(?<=DNS:)[^,]+' Uses Perl-compatible regex to extract DNS names after each 'DNS:' prefix.

Internal-looking names in the SAN confirm the server is used internally as well as externally. These names are candidates for virtual host enumeration even if they don't resolve in public DNS.

Probe CT Results for Live Hosts

Resolve and probe all discovered names in one pass to identify which are live and what they serve:

┌──(kali㉿kali)-[~]
└─$ httpx -l ct_subdomains.txt -status-code -title -tech-detect -o ct_live.txt 
https://dev.example.com [200] [Dev Portal] [nginx,PHP]
https://staging.example.com [401] [Staging] [Apache]
https://api.example.com [200] [API] [nginx]
Explain command
-l ct_subdomains.txt Read target hosts from the specified input file.
-status-code Display HTTP status code in the output.
-title Display the page title of each HTTP response.
-tech-detect Detect technologies used by the web application.
-o ct_live.txt Write output results to the specified file.

Staging and dev environments that return 401 are worth credential testing from other sources in scope. Any environment with a different tech stack than the main domain is independently enumerable and may have lower security maturity.

Related

Virtual Host Enumeration
Blog

Virtual Host Enumeration
Subdomain Bruteforce
Blog

Subdomain Bruteforce

Enumerate hidden subdomains via wordlist-based bruteforce using tools like gobuster, ffuf, and amass...

References