Forgotten subdomains

May 31, 2026

Forgotten Subdomains

 curl -s "https://crt.sh/?q=%25.target.com&output=json" -H "User-Agent: Mozilla/5.0" | jq -r '.[].name_value' 2>/dev/null | sed 's/*.//g' | tr 'A-Z' 'a-z' | sort -u

Certificate Transparency: Anything that ever got an SSL certificate ends up in a public log, so this digs up every old subdomain, even the dev and staging ones.

https://thedreydossier.substack.com/p/i-found-a-second-votegov-and-its

Keywords: blog geek

Reply via email