Find forgotten hosts and the domains connected to them.
What it does
Find overlooked subdomains and sibling domains for an organization's security review.
When to use it
Use when looking for staging, development, administrative or VPN hosts, mapping a domain's hostname footprint, or reviewing forgotten infrastructure.
How to use it
Give it a domain, organization name, or certificate; it returns a hostname inventory with source evidence, resolution results and confidence grades.
What you provide
- a domain, org name, or certificate
Uses
Latest review
What you need · 7
Uses jq to extract certificate hostnames from crt.sh JSON responses.
Uses subfinder to aggregate passive hostname sources.
Access · 5
This skill
crt.sh
Read
Queries crt.sh certificate records
passive DNS
Read
Queries passive DNS records