Certificate Transparency — The Recon Superpower

This is one of my favorite recon tricks because it feels like cheating. Certificate Transparency logs will hand you a company's subdomains — including internal-sounding and forgotten ones — basically for free. Let me explain this superpower.

The Background (Quick & Painless)

Every time a website gets an HTTPS certificate (the thing that makes the padlock appear), that certificate gets logged in PUBLIC, append-only logs called Certificate Transparency (CT) logs. This system exists for security — so sketchy certificates can be spotted.

But here's the gift for us: those certificates list the domain names they cover. So the CT logs are basically a giant public record of "here are domains and subdomains that exist." Including ones that aren't linked anywhere.

Why This Beats Guessing

Other subdomain methods either guess from wordlists (miss the weird ones) or scrape sources (incomplete). CT logs contain subdomains that were REAL enough to get a certificate — meaning they actually existed and were set up. That often includes:

• internal-vpn.target.com
• dev-api.target.com
• admin-staging.target.com
• secret-project-2024.target.com

Stuff a company would NEVER link publicly — but they got a cert for it, so it's in the logs.

How To Actually Use It

The easy way — crt.sh:

Just visit crt.sh and search %.target.com. You'll get a list of every certificate (and the domains on it) for that company. Instant subdomain list.

The tool way:

Most good subdomain tools (subfinder, amass) already query CT logs among their sources — which is a big part of WHY they're effective. But querying crt.sh directly sometimes surfaces things worth cross-checking.

The API way:

You can hit crt.sh's JSON output and pipe it into your recon pipeline:

curl -s "<https://crt.sh/?q=%25.target.com&output=json>" | jq -r '.[].name_value' | sort -u

curl -s "<https://crt.sh/?q=%25.target.com&output=json>" | jq -r '.[].name_value' | sort -u

The Workflow

1. Pull all domains from CT logs for your target
2. Clean and dedupe them
3. Check which are alive (httpx)
4. Zero in on the interesting names — anything with "dev," "internal," "staging," "admin," "test," "vpn," "api"
5. Those internal-sounding ones are usually less protected — hunt them first