Certificate Transparency Recon: Hostnames Logs Actually Give You

Certificate Transparency Recon: Hostnames Logs Actually Give You

Certificate Transparency is still one of the highest-signal passive sources in bug bounty. Anyone who minted a publicly trusted cert for *.target.example or a bare hostname left a paper trail. You get names without touching the company's DNS servers.

The skill is filtering. CT is noisy on purpose.

Query like you mean it

Use crt.sh, Censys, or other CT search with the apex and known acquisitions. Pull both wildcard and exact names. Export and dedupe. Sort by notBefore to see naming eras: the 2019 jira-old era, the 2024 prod-us-eks era.

Watch for:

• Staging and VPN names that never hit marketing sites
• Acquired domains still getting certificates under the parent account
• Internal-looking hostnames accidentally shipped to a public CA
• Typo domains the brand registered and certified once

Do not stop at the first page of results. Pagination hides the weird host that matters.

SANs lie in helpful ways

A single certificate may list twenty unrelated customers on a shared SaaS plan. If the organization field is a hosting provider, treat sibling SANs as guilty until proven yours. Prefer certs where the subject organization matches the target, or where the SAN is clearly under an in-scope DNS tree.

Expired certificates still name hosts. The host may be gone; the pattern remains for brute-force permutations. I've rebuilt an entire environment vocabulary from dead certs alone.

Also note issuers. Private PKI never lands in public CT. Public CT coverage means public trust paths—useful, not complete.

Wildcards deserve a separate pass. A cert for *.dev.target.example does not list every child, but it proves the naming zone exists and that someone expected many hosts under it. Pair that with a short, org-specific brute list instead of celebrating the wildcard alone.

Pre-certificate entries and briefly logged names matter too. A host that appeared once during a failed issuance attempt can still reveal an internal label ops never meant to advertise on the public site.

From name to proof

Resolve survivors. Check HTTP/TLS. A CT name that NXDOMAINs today still belongs in your notes for historical takeover angles (dangling CNAME to a released cloud resource). That is a different finding class—validate carefully before filing.

For live hosts, CT is just discovery. The report should describe the vulnerability or exposure on that host. Mention CT in methodology when the program asks how you found a non-obvious subdomain.

When two programs share a parent brand, keep CT exports labeled by policy scope. Filing a host from sibling brand B against program A is a common waste of triage time—and yours.

Workflow that stays maintainable

Keep a per-program set of seed domains. Re-query weekly on long engagements; new certs appear after every staging spin-up. Diff against your last export instead of rereading five thousand lines by eye.

Avoid claiming "CT bypasses DNS security." It does not. It reveals names someone already published to a log via certificate issuance.

CT recon rewards patience and a delete key. Keep the names that match scope and branding. Throw away the shared-hosting SAN soup.