PHASE: Certificate Transparency (CT)33% COMPLETION
Abort Mission
MODULE 02

Passive Subdomain Enumeration

Using sources like CRT.sh, VirusTotal, and search engines to find subdomains without touching the target.

Certificate Transparency (CT)

Every SSL certificate issued by a public CA is logged in a public ledger. This is the #1 source for subdomain discovery.

CRT.sh

A web interface for searching CT logs.
Query: `%.target.com`