cero
Scrapes domain names straight out of TLS certificates across IP ranges/ports - great for finding hosts that never appear in passive sources.
Tags: tls, certificates, subdomains
- Category
- recon
- Maintenance signal
- slow
Use this when: Intake. Use this on a root you are allowed to resolve. The output is a host list, not a finding.
Install
go
go install github.com/glebarez/cero@latestCommand templates
Names from certs
cero {target} | anew certnames.txt