Categories: Kali Linux

CertCrunchy – Silly Recon Tool That Uses Data From SSL Certificates To Find Potential HostNames

CertCrunchy is just a silly python script that either retrieves SSL Certificate based data from online sources, currently https://crt.sh/, https://certdb.com/, https://sslmate.com/certspotter/ and https://censys.io or given a IP range it will attempt to extract host information from SSL Certificates. If you want to use Censys.io you need to register for a API key.

Also Read Hcxdumptool – Small Tool To Capture Packets From WLAN Devices

How To Install CertCrunchy

git clone https://github.com/joda32/CertCrunchy.git
cd CertCrunchy
sudo pip3 install -r requirements.txt

How to use it?

Very simply -d to get hostnames for specific domain

  • -D to get hostnames for a list of domains (just stuff it in a line delimited text file)
  • -i to retrieve and parse certificates from hosts in a netblock / ip range (e.g. 192.168.0.0/24)
  • -T the thread count, makes stuff faster, but don’t over do it
  • -O to set the timeout on HTTP api requests in seconds (default is 3 seconds)
  • -o Output file name
  • -f Output format csv or json, csv is the default

API Keys & Configs

All API keys are stored in the api_keys.py file, below is a list of supported APIs requiring API keys.

R K

Recent Posts

Kali Linux Commands Cheat Sheet: Complete Quick Reference

This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…

1 week ago

What I Wish I Knew Before Learning Malware Analysis and Reverse Engineering

When I first started learning malware analysis and reverse engineering, I thought the hardest part…

2 weeks ago

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

3 weeks ago

git cherry-pick Command: Apply Commits from Another Branch

Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…

3 weeks ago

Best Email APIs for Secure Business Email: Why Developers Are Moving Beyond SMTP

Email is still one of the most important communication channels inside modern applications. Password resets,…

4 weeks ago

Nginx Commands in Linux: Start, Stop, Reload, Test, and Log

Nginx is a high-performance web server and reverse proxy trusted by some of the largest…

4 weeks ago