Subdomain Enumerator
Discover hidden subdomains using public Certificate Transparency (CT) logs. Essential for reconnaissance.
Searching Global Certificate Logs...
What is Subdomain Enumeration?
Subdomain enumeration is the process of finding all the subdomains of a specific primary domain (like api.example.com or dev.example.com). In cybersecurity, this is a critical first step in the Reconnaissance phase. It helps security professionals identify the full attack surface of an organization, which often includes forgotten dev environments, staging servers, or legacy portals that may not be as secure as the main website.
Passive Discovery
Our tool uses passive discovery by querying Certificate Transparency (CT) logs. This doesn't send a single packet to the target server, making it 100% stealthy.
DNS Mapping
Subdomains are often pointers to different servers or cloud infrastructure. Finding them helps you understand the technical layout of a company's web presence.
Importance of CT Logs
Certificate Transparency logs are public records of every SSL/TLS certificate issued for a domain. By searching these logs, we can reconstruct the history of subdomains that have ever had an HTTPS certificate. This is highly effective because most modern subdomains require HTTPS to function, leaving a permanent trail in the global logs.
Professional Insight
Hackers often look for "Subdomain Takeover" vulnerabilities—where a subdomain points to a service (like an old S3 bucket) that is no longer active. Use this tool to ensure your own domain isn't leaking exposed subdomains.
Use Cases for Security Teams
- Asset Identification: Discovering all internet-facing assets for an organization.
- Bug Bounty Hunting: Finding hidden targets that other researchers might have missed.
- Compliance Auditing: Ensuring that no unauthorized subdomains have been created.
- Infrastructure Analysis: Mapping out the third-party services (like Shopify or Zendesk) a company uses.
Frequently Asked Questions
Is this tool legal to use?
Yes. Querying public transparency logs is a standard industry practice. Our tool does not engage in "Active Brute Forcing" or dictionary attacks, which are often restricted by network policies.
Why are some found subdomains "dead"?
CT logs are a historical record. A subdomain might have had a certificate issued in the past but may no longer be active or point to a valid server today.
How can I secure my subdomains?
Ensure that all subdomains have updated security headers, use strong authentication, and that any DNS records pointing to defunct services are deleted immediately.