Discover subdomains via CT Logs (crt.sh) with DNS resolution for each result.
| Subdomain | IP Address | Status |
|---|
Forgotten subdomains (dev, staging, test) are one of the most common entry points for attackers. Subdomain enumeration helps discover your hidden attack surface and eliminate risks before an incident.
Search Certificate Transparency logs via crt.sh — discovers subdomains that had SSL certificates issued.
Each discovered subdomain is verified via DNS to confirm its activity and obtain its IP address.
Results can be copied or exported for further security analysis.
Subdomain enumeration discovers all subdomains of a domain using Certificate Transparency logs (crt.sh). This technique is widely used in security assessments to map the attack surface of a target, find forgotten dev/staging environments, and detect misconfigured services. All discovered subdomains are verified via DNS resolution to confirm if they are live.
Subdomain enumeration is the process of discovering all registered subdomains for a given domain. It uses Certificate Transparency logs (crt.sh), DNS records, and other public sources to compile a complete list.
The primary source is Certificate Transparency (CT) logs via crt.sh. When an SSL certificate is issued for a subdomain, it is logged in a public CT log. We also check DNS resolution for each discovered subdomain to confirm it is active.
Forgotten subdomains (dev, staging, test) are a common entry point for attackers. They may contain outdated software, open admin panels, or data leaks. Regular subdomain auditing is an important part of attack surface management.
Review each subdomain: is it still needed, should it be publicly accessible, is the software up to date. Remove unused DNS records, restrict access to dev/staging via IP filters or VPN, and update certificates.
Yes. We only use public data sources (CT logs, DNS). No aggressive scanning methods (brute force, zone transfer) are used. This is passive reconnaissance, similar to a Google search.