find-hidden-subdomains

find-hidden-subdomains is an OSINT tradecraft skill for enumerating an organization's subdomains and sibling domains passively — primarily from Certificate Transparency (CT) logs and passive DNS — without sending traffic to the target. It addresses attack-surface discovery: the forgotten staging, dev, admin, VPN, and internal hosts that announced themselves the moment someone requested a public TLS certificate, plus domains an organization did not know it owned.

The skill explains how CT works (append-only public logs, precertificates versus certificates, blindness to private/self-signed certs), how to query crt.sh via its JSON API and its read-only guest Postgres endpoint, how to mine certificate SAN fields and do identity searches on an organization name, and how to bring in tooling like subfinder and amass. Bundled references cover additional CT front-ends and a detailed name-pattern triage matrix that reads a hostname's label to infer its likely purpose (environments, remote-access appliances, mail, admin panels, CI/registries, identity providers, APIs, storage, backups) and prioritize passive follow-up. It repeatedly frames results as historical evidence — most CT hits do not resolve — and treats DNS resolution as the liveness oracle.

It targets security professionals doing authorized attack-surface mapping, vendor and supply-chain review, brand-infringement discovery, and M&A technical diligence. This is dual-use reconnaissance tradecraft — the same enumeration underpins both defensive asset inventory and the first phase of an attack. Its guidance is notably restrained (passive-only, explicit instructions never to attempt credentials and to report exposed management/backup hosts through abuse contacts), but subdomain and infrastructure enumeration automation is inherently reconnaissance capability, which lowers its security rating relative to a purely benign skill.