Skip to content

Instantly share code, notes, and snippets.

@maxrodrigo

maxrodrigo/crtsh-enum.sh

Last active October 27, 2020 01:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save maxrodrigo/dec5c1d676e2cfbfcf1935414ed4c7a8 to your computer and use it in GitHub Desktop.
Save maxrodrigo/dec5c1d676e2cfbfcf1935414ed4c7a8 to your computer and use it in GitHub Desktop.
Download ZIP
`crt.sh` PostgreSQL interface subdomain query
Raw
crtsh-enum.sh
#!/usr/bin/env bash
# Usage: ./crtsh-subdomains.sh domain.com
query="SELECT ci.NAME_VALUE NAME_VALUE FROM certificate_identity ci WHERE ci.NAME_TYPE = 'dNSName' AND reverse(lower(ci.NAME_VALUE)) LIKE reverse(lower('%.$1'));"
(echo $1; echo $query | \
psql -t -h crt.sh -p 5432 -U guest certwatch | \
sed -e 's:^ *::g' -e 's:^*\.::g' -e '/^$/d' | \
sed -e 's:*.::g';) | sort -u
@maxrodrigo
Copy link
Author

maxrodrigo commented Oct 27, 2020 •
edited

More in: https://0xffsec.com/handbook/information-gathering/subdomain-enumeration/#crtsh-postgresql-interface

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment