CT-Exposer - An OSINT Tool That Discovers Sub-Domains By Searching Certificate Transparency Logs

Discover sub-domains by searching through Certificate Transparency logs.

What is CT?
Certificate Transparency (CT) is an experimental IETF standard. The goal of it was to allow the public to audit which certificates were created by Certificate Authorities (CA). TLS has a weakness that comes from the large list of CAs that your browser implicitly trusts. If any of those CAs were to maliciously create a new certificate for a domain, your browser would trust it. CT adds benefits to TLS certificate trust: Companies can monitor who is creating certificates for the domains they own. It also allows browsers to verify that the certificate for a given domain is in the public log record.
These logs end up being a gold mine of information for penetration testers and red teams.

What can you find with ct-exposer?
ct-exposer will query the CT logs for a given domain, and then try to do DNS lookups for the domains to see which ones exist in DNS. In my experience, so far, I've found numerous sub-domains that were not located with 'site:domain.com' google searches. Keep in mind that the domains that do not resolve, they can either be old domains, or internal only domains (Ex: you need access to the internal DNS server to resolve them).

Python3, gevent, requests, and urllib3.
pip3 install -r requirements.txt

usage: ct-exposer.py [-h] -d DOMAIN [-u] [-m]

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        domain to query for CT logs, ex: domain.com
  -u, --urls            ouput results with https:// urls for domains that
                        resolve, one per line.
  -m, --masscan         output resolved IP address, one per line. Useful for
                        masscan IP list import "-iL" format.

Example output
python3 ct-exposer.py -d teslamotors.com
[+]: Downloading domain list...
[+]: Download of domain list complete.
[+]: Parsed 76 domain(s) from list.

[+]: Domains found: adfs.teslamotors.com akamaisecure.qualtrics.com cn.auth.teslamotors.com cnvpn.teslamotors.com energystorage.teslamotors.com epc.teslamotors.com euvpn.teslamotors.com extconfl.teslamotors.com extissues.teslamotors.com fleetview.teslamotors.com leaseapp.teslamotors.com leaseappde.teslamotors.com lync.teslamotors.com mycn-origin.teslamotors.com origin-www45.teslamotors.com owner-api.teslamotors.com plcvpn.teslamotors.com quickbase.teslamotors.com resources.teslamotors.com sdlcvpn.teslamotors.com service.teslamotors.com sftp.teslamotors.com shop.eu.teslamotors.com shop.teslamotors.com shop.uk.teslamotors.com smswsproxy.teslamotors.com supercharger.teslamotors.com suppliers.teslamotors.com tesla.com teslamotors.com teslaplm-external.teslamotors.com toolbox.teslamotors.com trt.teslamotors.com upload.teslamotors.com us.auth.teslamotors.com vpn.teslamotors.com wechat.teslamotors.com wsproxy.teslamotors.com www-origin.teslamotors.com www.teslamotors.com xmail.teslamotors.com xmailcn.teslamotors.com

[+]: Domains with no DNS record:
none cdn02.c3edge.net
none creditauction.teslamotors.com
none evprd.teslamotors.com
none imail.teslamotors.com
none jupytersvn.teslamotors.com
none leadgen.teslamotors.com
none lockit.teslamotors.com
none lockpay.teslamotors.com
none neovi-vpn.teslamotors.com
none origin-wte.teslamotors.com
none referral.teslamotors.com
none resources.tesla.com
none securemail.teslamotors.com
none shop.ca.teslamotors.com
none shop.no.teslamotors.com
none sip.teslamotors.com
none sjc04p2staap04.teslamotors.com
none sling.teslamotors.com
none tesla3dx.teslamotors.com
none testimail.teslamotors.com
none toolbox-energy.teslamotors.com
none vpn-node0.teslamotors.com
none wd.s3.teslamotors.com
none www-uat2.teslamotors.com
none www45.teslamotors.com

CT-Exposer - An OSINT Tool That Discovers Sub-Domains By Searching Certificate Transparency Logs CT-Exposer - An OSINT Tool That Discovers Sub-Domains By Searching Certificate Transparency Logs Reviewed by Zion3R on 6:02 PM Rating: 5