OSINT

crt.sh

Certificate Transparency log search for subdomains.

beginner

Web

Reconnaissance

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Finding subdomains issued certificates historically.

Search %.example.com; export names; dedupe into recon list.

Free, powerful passive subdomain source.

Commands & usage

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq '.[].name_value'

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Maltego

Graph-based link analysis for people, domains, infrastructure, and relationships.

theHarvester

Gathers emails, subdomains, hosts, and employee names from public sources.

Recon-ng

Modular recon framework with workspace DB and API-backed modules.

SpiderFoot

Automated OSINT scanner with web UI covering 200+ data sources.

Sherlock

Hunt usernames across hundreds of social sites.

Maigret

Username OSINT tool with report generation across many sites.