1. CT log search
crt.sh searches certificate transparency logs, returning every certificate ever issued for the domain and its subdomains.
# crt.sh?q=example.com lists all certsTyporithm · medium
Certificates & Subdomains
cert-subdomainsosintcertificate-transparencysubdomainattack-surface
Saved on this device
Full lesson · 8 learning steps Open any exercise for focused practice
10%
Step 1 of 8 · intro card
Learn Certificates & Subdomains
Domain & Infrastructure
Certificate transparency logs publicly record every issued certificate, often leaking subdomains an organization never meant to expose. Passive tools like amass and subfinder aggregate these sources; the complete subdomain list is the organization's external attack surface.
Certificate transparency (CT) is a public, append-only log of every TLS certificate a CA issues. Because the subject and SAN fields name the hosts, CT logs become a searchable index of an organization's subdomains.
Tools like amass in passive mode and subfinder query CT logs alongside other open sources — search engines, DNS datasets, threat-intel feeds — and merge the results into a deduplicated subdomain list.
Certificates issued for internal or staging hosts still land in CT logs, leaking names that were never meant to be public. The full enumerated list defines the external attack surface for authorized testing.
01
CT logs publicly record every issued certificate.
02
amass and subfinder aggregate passive subdomain sources.
03
The full subdomain list is the external attack surface.
# crt.sh?q=example.com lists all certs
amass enum -passive -d example.com
subfinder -d example.com
# certs can leak internal subdomainsRead the implementation
Connect each part of the code to the concept before you type.
2. Passive enumeration
amass enum -passive aggregates many open sources, including CT logs, without sending probes to the target.
amass enum -passive -d example.com3. Subdomain finder
subfinder queries dozens of passive data sources to enumerate a domain's subdomains quickly.
subfinder -d example.com4. Leaked names
A certificate issued for an internal host publishes that hostname in CT logs, expanding the known attack surface.
# certs can leak internal subdomainsA complete learning loop
01
Understand
Read the concept map and follow the code breakdown.
02
Reconstruct
Type the implementation, repair mistakes and work through every recall exercise.
03
Verify
Use the final check without hints; revisit weak concepts in short practice sessions.