<story><title>Subdomain.center – discover all subdomains for a domain</title><url>https://www.subdomain.center/</url></story><parent_chain><item><author>gnyman</author><text>You cannot hide anything on the internet anymore, the full IPv4 range is scanned regularly by multiple entities. If you open a port on a public IP it will get found.&lt;p&gt;If it&amp;#x27;s a obscure non-standard port it might take longer, but if it&amp;#x27;s on any of the standard ports it will get probed very quickly and included tools like shodan.io&lt;p&gt;The reason why I&amp;#x27;m repeating this, is that not everyone knows this. People still  (albeit less) put up elastic and mongodb instances with no authentication on public IP&amp;#x27;s.&lt;p&gt;The second thing which isn&amp;#x27;t well known is the Certificate Transparency logs. This is the reason why you can&amp;#x27;t (without a wildcard cert) hide any HTTPS service. When you ask Let&amp;#x27;s Encrypt (or any CA actually) to generate veryobscure.domain.tld they will send that to the Certificate Transparency logs. You can find every certificate which was minted for a domain on a tool like &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;crt.sh&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;crt.sh&lt;/a&gt;&lt;p&gt;There are many tools like subdomain.center, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;hackertarget.com&amp;#x2F;find-dns-host-records&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;hackertarget.com&amp;#x2F;find-dns-host-records&amp;#x2F;&lt;/a&gt; comes to mind. The most impressive one I&amp;#x27;ve seen, which found more much more than expected, is Detectify (which is a paid service, no affiliation), they seem to combine the passive data collection (like subdomain.center) with active brute to find even more subdomains.&lt;p&gt;But you can probably get 95% there by using CT and a brute-force tool like &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;aboul3la&amp;#x2F;Sublist3r&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;aboul3la&amp;#x2F;Sublist3r&lt;/a&gt;</text></item></parent_chain><comment><author>fuzzy2</author><text>The Certificate Transparency Log is very important. I recently spun up a service with HTTPS certs by Let&amp;#x27;s Encrypt. By coincidence I was watching the logs. Within just 80 seconds of the certificate being issued I could see the first automated &amp;quot;attacks&amp;quot;.&lt;p&gt;If you get a certificate, be ready for the consequences.</text></comment>
<story><title>Subdomain.center – discover all subdomains for a domain</title><url>https://www.subdomain.center/</url></story><parent_chain><item><author>gnyman</author><text>You cannot hide anything on the internet anymore, the full IPv4 range is scanned regularly by multiple entities. If you open a port on a public IP it will get found.&lt;p&gt;If it&amp;#x27;s a obscure non-standard port it might take longer, but if it&amp;#x27;s on any of the standard ports it will get probed very quickly and included tools like shodan.io&lt;p&gt;The reason why I&amp;#x27;m repeating this, is that not everyone knows this. People still  (albeit less) put up elastic and mongodb instances with no authentication on public IP&amp;#x27;s.&lt;p&gt;The second thing which isn&amp;#x27;t well known is the Certificate Transparency logs. This is the reason why you can&amp;#x27;t (without a wildcard cert) hide any HTTPS service. When you ask Let&amp;#x27;s Encrypt (or any CA actually) to generate veryobscure.domain.tld they will send that to the Certificate Transparency logs. You can find every certificate which was minted for a domain on a tool like &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;crt.sh&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;crt.sh&lt;/a&gt;&lt;p&gt;There are many tools like subdomain.center, &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;hackertarget.com&amp;#x2F;find-dns-host-records&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;hackertarget.com&amp;#x2F;find-dns-host-records&amp;#x2F;&lt;/a&gt; comes to mind. The most impressive one I&amp;#x27;ve seen, which found more much more than expected, is Detectify (which is a paid service, no affiliation), they seem to combine the passive data collection (like subdomain.center) with active brute to find even more subdomains.&lt;p&gt;But you can probably get 95% there by using CT and a brute-force tool like &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;aboul3la&amp;#x2F;Sublist3r&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;aboul3la&amp;#x2F;Sublist3r&lt;/a&gt;</text></item></parent_chain><comment><author>implements</author><text>Recently, I opened 80 and 443 so I could use LetsEncrypt’s acme-client to get a certificate (and then test it). Tightening up security a bit, I configured an http relay to filter people accessing 80 by ip address rather than domain name - &lt;i&gt;some scanners are still trying domain and sub-domain names I was using weeks ago&lt;/i&gt; - which goes to show how organised hackers are about attacking targets.</text></comment>