Mine certificate transparency for hidden subdomains

Certificates are logged publicly, so any host that ever got a TLS cert is discoverable, including dev, staging, and admin names that are not in wordlists.

curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u
subfinder -d target.com -all -silent | anew subs.txt

Resolve and probe what is live.

dnsx -l subs.txt -silent | httpx -silent -title -tech-detect -status-code

Pro note: pull from multiple CT sources since each has gaps, and include wildcard-issued names. Names that resolve internally only are still gold for later pivoting; keep them even if they do not respond from the outside.