skills.rest
UseOSINT
UseOSINTOFFICIAL
Explore all skills by this author →
GitHub

find-hidden-subdomains

Enumerate subdomains and sibling domains from Certificate Transparency logs and passive DNS.

38|2|Updated Aug 2, 2026
Search Tags:#reconnaissance#subdomain enumeration#attack surface#osint#certificate transparency#crt.sh#passive dns
One-click install
npx skills add https://github.com/UseOSINT/Skills --skill find-hidden-subdomains-useosint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: find-hidden-subdomains
Source: https://github.com/UseOSINT/Skills/tree/main/skills/find-hidden-subdomains
Command: npx skills add https://github.com/UseOSINT/Skills --skill find-hidden-subdomains-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Organizations lose track of their own infrastructure, and forgotten staging, VPN, or admin hosts become security blind spots. This Skill maps a domain's full hostname footprint passively, without sending any traffic to the target, using public certificate and DNS data. ## Core Features & Use Cases - Certificate Transparency enumeration: Query crt.sh and other CT front-ends with wildcard and organization-name searches to surface every hostname ever issued a public certificate, including long-dead hosts. - Multi-source aggregation and resolution: Combine CT, passive DNS, and wordlist tools (subfinder, amass, dnsx), detect wildcard-DNS zones, and grade each finding as confirmed, probable, or unconfirmed. - Hostname triage: Interpret name patterns (dev, vpn, jira, legacy) to prioritize follow-up, using the included reference guides on source coverage and name-pattern triage. - Use Case: During vendor due diligence on example.com, run a crt.sh wildcard query, deduplicate precert pairs, resolve candidates, and discover a forgotten staging host plus an undisclosed sibling domain registered to the same organization. ## Quick Start Use the find-hidden-subdomains skill to enumerate all subdomains of example.com passively and grade which ones are confirmed live assets.

Frequently Asked Questions about find-hidden-subdomains

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains of a domain passively?▼

Query Certificate Transparency logs via crt.sh with a wildcard search like %.example.com and output=json, then deduplicate the name_value fields. Supplement with passive DNS sources and aggregators like subfinder or amass in passive mode, then resolve candidates with dnsx.

What is Certificate Transparency and how does it reveal subdomains?▼

Certificate Transparency requires publicly trusted TLS certificates to be published in append-only logs, so every hostname ever issued a browser-trusted certificate is searchable. Tools like crt.sh index these logs, exposing historical and current subdomains without touching the target.

subfinder vs amass for subdomain enumeration?▼

subfinder queries many passive sources in parallel and is the practical default, while amass has a broader source mix and its own graph store but runs slower. Both need API keys configured for keyed sources or results are silently truncated.

Why do CT subdomain results include hosts that don't resolve?▼

CT logs are append-only history of certificate requests, not a live asset inventory, so most historical names are dead. Resolve candidates to separate live hosts from dead ones, and treat dead names as dating and naming-convention evidence rather than assets.

Can Certificate Transparency find hosts behind wildcard certificates?▼

No, a wildcard certificate like *.example.com names no specific hosts, so CT goes dark from that point. Mine CT for the period before the wildcard was issued, then switch to passive DNS, archives, and search indexes for hostnames.

Is passive subdomain enumeration legal and in scope?▼

Reading CT logs and passive DNS is querying data published by design and never touches the target. DNS brute-forcing and HTTP probing with tools like httpx are active, generate traffic to the target, and require explicit written scope authorization.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

whois-lookup

Perform WHOIS lookups for domains or IP addresses and parse registration details.

Community
Intermediate
JingyueCongJingyueCong

shodan-reconnaissance

Discovers and analyzes internet-exposed assets using the Shodan API.

Community
Advanced
GeekKingCloudGeekKingCloud
6

assess-seo

Audit public web pages for SEO readiness with scored, prioritized findings.

Community
Advanced
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced