apexdiscoverylisted

# ApexDiscovery Discover all apex/root domains owned by a target organization using multiple techniques. **Philosophy:** > "For every apex domain you find, you 4x your chance of hacking the target." > — Jason Haddix **Why this matters:** Companies own many domains — acquisitions, regional sites, product brands, internal tools. Subdomain enumeration only works on domains you know about. This skill finds the domains you don't. ## Important: Organization Name Discovery During recon, you'll often discover **additional organization names** that should be searched: - WHOIS shows "Tesla Motors Inc" but ASN shows "Tesla Energy" - ASN data reveals acquired company "SolarCity" - Cert org field shows "Acme Holdings LLC" (parent company) **The workflow should be ITERATIVE:** 1. Search initial org name 2. Collect any NEW org names discovered 3. **Present to user:** "Found these related orgs: X, Y, Z. Search them too?" 4. If yes → recursive search on new orgs 5. Repeat until no new orgs found **Where new orgs appear:** | Source | Field to Check | |--------|----------------| | WHOIS | Registrant Organization | | ASN (bgp.he.net) | AS Organization Name | | Certificates | O= (Organization) field | | DomLink | Company Names section | ## Workflow Routing | Workflow | Trigger | What It Does | |----------|---------|--------------| | **Quick** | "find related domains", "apex discovery", DEFAULT | Reverse WHOIS + crt.sh org search | | **Full** | "full apex discovery", "all company domains