Subdomain Discovery Just Got a Lot More Complete, Thanks to Certificate Transparency
Subdomain discovery used to work the way most tools still do it: guess. A wordlist of roughly 70 common names, www, api, staging, admin, and so on, checked against a domain to see what resolves. It works, but it's fundamentally limited to what someone thought to include on the list. It was never going to find internal-billing-v2.example.com.
That's changed. Subdomain discovery now also queries crt.sh, a free public certificate transparency log search, alongside the wordlist pass.
What certificate transparency actually gives you
Every SSL certificate any public Certificate Authority has ever issued gets logged publicly, permanently, by design, that's what certificate transparency is for. Querying crt.sh for a domain returns every hostname a certificate has ever been issued for under it, including the subdomains no wordlist would ever guess, an old internal tool, a long-abandoned dev box, a billing system nobody documented outside the team that built it.
How it works in practice
Both discovery methods run automatically, in parallel, on every Starter+ scan. Results from the wordlist and from crt.sh feed the exact same pipeline afterward, resolve, probe, check for takeover risk, so there's no second-class result depending on how a subdomain was found. crt.sh needs no API key, it's free and unauthenticated, which keeps this fast and simple to run on every scan.
A couple of practical details worth knowing:
- Results are capped at 150 candidates, sorted shortest-hostname-first, since a large or old domain can return thousands of names once you count every expired certificate and long-dead dev box ever issued one. Shortest-first means the most plausible real subdomains get checked before the deep, obscure ones.
- If crt.sh is slow or unavailable, the scan degrades gracefully to wordlist-only results rather than failing outright or, worse, falsely reporting that no subdomains were found.
- Each subdomain in the report now carries a small badge showing whether it was found via wordlist or certificate transparency, so you can see exactly how a given result surfaced.
Why we built it
A wordlist can only ever find what someone guessed in advance. Certificate transparency logs are a public record of every subdomain a company has ever put a cert on, which is a fundamentally more complete discovery method than guessing, and it's the same OSINT technique competitor tooling like AppCheck runs as part of its own reconnaissance. Since crt.sh needs no authentication and returns structured results, it was a natural addition to a discovery pass that was already running.
Availability
Live now, automatically, on every Starter and above scan, running alongside the existing wordlist pass with no extra configuration needed.
Certificate transparency subdomain discovery is included in every Starter+ scan, alongside subdomain takeover detection. See plans →