find-hidden-subdomainslisted

# Find hidden subdomains The hosts an organization forgot about are the ones worth finding, and most of them announced themselves the moment someone requested a TLS certificate. Certificate Transparency turns that into a searchable, permanent, historical index — free and completely passive. The beginner's mistake is treating a CT hit as a live host: most of what you pull back does not resolve, and that is information too, not noise. ## Which source first | You hold | Start with | Why | |---|---|---| | An apex domain | crt.sh wildcard query | Broadest free coverage, includes long-dead names | | A domain behind a wildcard cert | Passive DNS, then archives | CT will only show you `*.example.com` | | A guess at a naming convention | CT to learn the convention, then a wordlist | Learn the pattern before brute-forcing anything | | An org name, not a domain | Certificate search by subject organization | Finds domains you did not know they owned | | A cert you already have | Its SANs, then its serial and issuer | SANs give siblings; serial finds the exact cert elsewhere | | A need for *current* hosts only | Resolve the candidate list | CT is historical by nature; DNS is the liveness oracle | ## How CT actually works CAs submit every certificate they issue to append-only, cryptographically verifiable public logs. The log returns a Signed Certificate Timestamp, and mainstream browsers refuse to trust a publicly-trusted certificate that does not carry SCTs from qualified logs. So p