ct-exposer : An OSINT Tool That Discovers Sub-Domains By Searching Certificate Transparency Logs

ct-exposer will query the CT logs for a given domain, and then try to do DNS lookups for the domains to see which ones exist in DNS. In my experience, so far, I’ve found numerous sub-domains that were not located with ‘site:domain.com’ google searches.

Keep in mind that the domains that do not resolve, they can either be old domains, or internal only domains (Ex: you need access to the internal DNS server to resolve them).

Certificate Transparency (CT) is an experimental IETF standard. The goal of it was to allow the public to audit which certificates were created by Certificate Authorities (CA). TLS has a weakness that comes from the large list of CAs that your browser implicitly trusts.

If any of those CAs were to maliciously create a new certificate for a domain, your browser would trust it. CT adds benefits to TLS certificate trust: Companies can monitor who is creating certificates for the domains they own.

It also allows browsers to verify that the certificate for a given domain is in the public log record. These logs end up being a gold mine of information for penetration testers and red teams.

ct-exposer Usage

usage: ct-exposer.py [-h] -d DOMAIN [-u] [-m]

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        domain to query for CT logs, ex: domain.com
  -u, --urls            ouput results with https:// urls for domains that
                        resolve, one per line.
  -m, --masscan         output resolved IP address, one per line. Useful for
                        masscan IP list import "-iL" format.

Also ReadInfog – Information Gathering Tool

Example output

python3 ct-exposer.py -d teslamotors.com
[+]: Downloading domain list...
[+]: Download of domain list complete.
[+]: Parsed 76 domain(s) from list.

[+]: Domains found:	adfs.teslamotors.com	akamaisecure.qualtrics.com	cn.auth.teslamotors.com	cnvpn.teslamotors.com	energystorage.teslamotors.com	epc.teslamotors.com	euvpn.teslamotors.com	extconfl.teslamotors.com	extissues.teslamotors.com	fleetview.teslamotors.com	leaseapp.teslamotors.com	leaseappde.teslamotors.com	lync.teslamotors.com	mycn-origin.teslamotors.com	origin-www45.teslamotors.com	owner-api.teslamotors.com	plcvpn.teslamotors.com	quickbase.teslamotors.com	resources.teslamotors.com	sdlcvpn.teslamotors.com	service.teslamotors.com	sftp.teslamotors.com	shop.eu.teslamotors.com	shop.teslamotors.com	shop.uk.teslamotors.com	smswsproxy.teslamotors.com	supercharger.teslamotors.com	suppliers.teslamotors.com	tesla.com	teslamotors.com	teslaplm-external.teslamotors.com	toolbox.teslamotors.com	trt.teslamotors.com	upload.teslamotors.com	us.auth.teslamotors.com	vpn.teslamotors.com	wechat.teslamotors.com	wsproxy.teslamotors.com	www-origin.teslamotors.com	www.teslamotors.com	xmail.teslamotors.com	xmailcn.teslamotors.com

[+]: Domains with no DNS record:
none	cdn02.c3edge.net
none	creditauction.teslamotors.com
none	evprd.teslamotors.com
none	imail.teslamotors.com
none	jupytersvn.teslamotors.com
none	leadgen.teslamotors.com
none	lockit.teslamotors.com
none	lockpay.teslamotors.com
none	neovi-vpn.teslamotors.com
none	origin-wte.teslamotors.com
none	referral.teslamotors.com
none	resources.tesla.com
none	securemail.teslamotors.com
none	shop.ca.teslamotors.com
none	shop.no.teslamotors.com
none	sip.teslamotors.com
none	sjc04p2staap04.teslamotors.com
none	sling.teslamotors.com
none	tesla3dx.teslamotors.com
none	testimail.teslamotors.com
none	toolbox-energy.teslamotors.com
none	vpn-node0.teslamotors.com
none	wd.s3.teslamotors.com
none	www-uat2.teslamotors.com
none	www45.teslamotors.com