crt.sh is a single-binary Go utility that fans a domain query out to four Certificate Transparency log sources in parallel, giving authorized bug bounty hunters and asset inventory teams fast, key-free subdomain discovery.
| Tool | az7rb/crt.sh — fast, parallel subdomain enumeration across 4 Certificate Transparency sources in a single Go binary |
| Category | Passive reconnaissance / subdomain enumeration (OSINT) |
| Primary Use | Mapping externally visible subdomains of domains you are authorized to test, using crt.sh, certspotter, crt.name, and Shodan CTL |
| Safe Use | Educational and documentary analysis for authorized professionals: bug bounty programs with defined scope, penetration tests under written authorization, and internal asset inventory. Only query assets you own or are contracted to assess. |
| Telemetry Note | Purely passive from the target's perspective — no packets touch the client's infrastructure; all queries hit public CT log APIs. Defenders cannot observe these queries on their own networks, but the underlying CT data is equally available to blue teams for shadow-IT and rogue-certificate detection. |
az7rb/crt.sh is a compact Go rewrite of what was originally a Bash script — the README links the earlier v1.0.0 and v2.0.0 releases as historical artifacts — and the current incarnation is a compiled binary that requires no API keys and no external dependencies. The pitch is straightforward: take a domain, query four Certificate Transparency sources simultaneously, deduplicate the results, and emit them as text, JSON, or a Burp Suite scope file. At roughly 363 stars and an MIT license, it sits comfortably in the mainstream of bug bounty reconnaissance tooling, and the README is unusually candid about how the thing actually works, which makes it worth a proper teardown.
The core architecture is fan-out parallelism over HTTP. The four sources are crt.sh itself (operated by Sectigo, queried via its JSON API using a %.domain wildcard), certspotter from SSLMate with automatic pagination of results, crt.name (an independent aggregator that reads Google Argon, Sectigo, and Cloudflare CT logs), and Shodan's Certificate Transparency log index at ctl.shodan.io. Because all four are hit concurrently, the README correctly notes that total scan time equals the slowest source rather than the sum — in the demo output, crt.sh takes 7412ms while the other three finish in under 700ms, so the Comodo-backed endpoint is the pacing item.
Installation is a single command for anyone with a Go toolchain: go install github.com/az7rb/crt.sh/v3@latest. For everyone else, the Releases page ships prebuilt archives covering linux_amd64, linux_arm64, darwin_amd64, darwin_arm64, and windows_amd64, and there is a documented source build using go build -ldflags "-X main.version=3.0.1". The README requires Go 1.21+ per its badge, which tells you the codebase is recent rather than a stale script rescued from a gist — a meaningful signal when so much recon tooling on GitHub is abandoned after one conference talk.
The CLI surface is deliberately small. -d takes a single domain or a comma-separated list, -l reads a file of domains one per line, and -O pivots the search to an organization name through crt.sh — a subtle but interesting feature, since org-level certificate searches let you enumerate infrastructure across multiple registered domains belonging to the same entity, which is exactly the kind of scope-wide asset discovery a bug bounty hunter needs before the program's in-sence list does it for them. Output format is controlled with -f txt|json|burp, -o names the output file, -a appends instead of overwrites, -t tunes the per-source HTTP timeout (default 30 seconds), and -q enables quiet, pipe-safe mode.
That -q flag deserves attention because it defines where this tool lives in a workflow. The README shows it piping directly into httpx -silent for liveness checking and into anew for incremental result accumulation — the canonical subdomain enumeration pipeline. crt.sh the tool is deliberately just the first stage: it produces names, not evidence. Nobody exploits anything with it; it answers the question "what hostnames have certificates issued for this domain," which is a public-data question by construction of the CT ecosystem itself.
The -s flag lets you skip individual sources by name (crt.sh, certspotter, crt.name, shodan-ctl), which matters operationally because source reliability varies — the slow crt.sh endpoint is the obvious candidate to drop when you need speed over coverage, or when one API is rate-limiting you. There is also a -update flag for self-updating the binary, a small quality-of-life feature that suggests the author expects the tool to live on operators' boxes long-term rather than be pulled fresh for each engagement.
Output handling is where the tool shows more polish than its size implies. In default txt mode, source status lines update in place as each finishes (✔ shodan-ctl → 9 found [263ms]) and results stream live, so you get visibility into which sources are productive without waiting for the slowest one. The json format is genuinely structured: per-source counts and durations, a timestamp, a total, and the deduplicated subdomain array — the kind of output you can feed into a reporting pipeline or diff between runs to detect newly issued certificates, which is a defensive use case as much as an offensive one.
The third output format, -f burp, generates a Burp Suite advanced scope JSON with advanced_mode enabled and per-host include entries using anchored regexes like ^api\.hackerone\.com$ with protocol set to any. Importing this via Project → Import means the enumeration results flow directly into an authorized web assessment's proxy configuration — a thoughtful integration that removes the tedious manual scope-entry step and reduces the risk of accidentally testing out-of-scope hosts, which is a compliance win for anyone working a defined bug bounty or pentest scope.
From a defender's perspective, tools like this are worth understanding precisely because they are invisible to you. All four queries go to third-party CT aggregators over HTTPS; nothing touches the target's network, nothing appears in WAF or IDS logs. The corollary is that CT data is symmetric: your blue team can run the identical query against your own domains and diff the results over time to find forgotten dev endpoints, shadow infrastructure, and certificates issued for hostnames nobody remembers requesting. The same JSON output that feeds a bug hunter's pipeline feeds a certificate inventory review.
The repo's topic tags — bug-bounty, subdomain-enumeration, crtsh — and its placement under the author's BugBountyzip collection, which the README promotes as a curated toolset, frame the intended audience clearly: authorized bug bounty researchers who need a fast, dependency-free first-pass enumerator. The tool doesn't attempt brute-force wordlist guessing, DNS resolution, or port scanning; it is purely passive CT correlation, which keeps it both fast and low-noise.
Caveats worth noting: the README's own demo shows meaningful variance in per-source results (crt.name returned 31 names where certspotter returned 9), so single-source enumeration is measurably incomplete and the four-way fan-out is the tool's actual value proposition. Coverage still depends entirely on certificates having been issued — CT logs know nothing about hosts that never got a cert — so this complements rather than replaces active DNS techniques later in the pipeline. Within its niche, though, crt.sh is a well-scoped, well-documented piece of kit that does one thing cleanly and gets out of the way.
az7rb/crt.sh.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.