Guide
Finding subdomains with certificate transparency logs
Every time a certificate authority issues a TLS certificate, it is required to log that certificate in a public, append-only certificate transparency (CT) log. Those logs were built to catch mis-issued certificates, but they double as one of the richest, most reliable sources of subdomain data on the internet — and reading them touches the target not at all.
What certificate transparency actually is
CT logs are public ledgers of every certificate a participating CA issues. Browsers now refuse certificates that are not logged, so coverage is effectively complete for anything served over HTTPS. Aggregators like crt.sh and CertSpotter index these logs and let you query every certificate ever issued for a domain and its subdomains.
Because the data lives in a third-party ledger, querying it sends zero packets to the target. There is no scan to detect, no rate limit on the victim's side, and no authorisation needed to look — you are reading a public record, the same way anyone can read a domain's WHOIS.
Why it maps the attack surface so well
Certificates leak names teams assume are private. A wildcard cert is unremarkable, but Subject Alternative Name fields routinely enumerate staging, internal-sounding, and one-off hostnames — vpn.acme.com, jenkins.acme.com, old-shop.acme.com — long before anyone links to them publicly.
The highest-value finds are the assets nobody remembers: the staging box left with default credentials, the marketing microsite pointing at a deprovisioned cloud bucket ripe for takeover, the forgotten admin panel. CT is where those first become visible.
From a log query to a live asset list
A raw CT dump is noisy: expired certs, duplicates, wildcards, and hostnames that no longer resolve. The useful artefact is a deduplicated set of names that resolve today, ideally cross-referenced with passive DNS so you are not relying on a single source.
ApexDrift pulls from crt.sh, CertSpotter, and AlienVault OTX, dedupes the results, and resolves each host through public resolvers — turning a pile of certificate records into a current, passive-only asset list you can hand to the next stage of an engagement.