---
title: "Comment by kafre02 on \"Network Security: Passive Reconnaissance (TryHackMe)\" | Hashnode"
description: "There's been an update, right at the end of DNSDumpster subsection \"Certificate Transparency (CT) Logs The most effective passive subdomain discovery method tod"
url: "https://hashnode.com/posts/network-security-passive-reconnaissance-tryhackme/67d73ce517a11e5ce15f1f53/comment/6aabe86b949e7d73c9610129"
---

[Discussion](https://hashnode.com/posts/network-security-passive-reconnaissance-tryhackme/67d73ce517a11e5ce15f1f53)

Comment [Network Security: Passive Reconnaissance (TryHackMe)](https://hashnode.com/posts/network-security-passive-reconnaissance-tryhackme/67d73ce517a11e5ce15f1f53)

[kafre02](https://hashnode.com/@kafre02)

[Sep 17](https://hashnode.com/posts/network-security-passive-reconnaissance-tryhackme/67d73ce517a11e5ce15f1f53/comment/6aabe86b949e7d73c9610129)

There's been an update, right at the end of DNSDumpster subsection

"Certificate Transparency (CT) Logs

The most effective passive subdomain discovery method today is Certificate Transparency logs, accessible through crt\[dot\]sh.

Certificate Transparency is a public logging framework (mandatory since approximately 2015) that records every SSL/TLS certificate issued by participating Certificate Authorities. Each certificate contains a Subject Alternative Name (SAN) field listing the domains and subdomains it covers. By searching these logs, you can discover subdomains without sending any traffic to the target.

To use crt\[dot\]sh, visit their site and search for %.\[t\]ryhackme\[.\]com. The % wildcard matches any subdomain. The results will list every certificate issued for subdomains of tryhackme\[dot\]com, often revealing 10 to 100 times more subdomains than DNSDumpster alone.

crt\[dot\]sh is fully passive, operates in real time, and has no rate limits for basic use.

Other passive subdomain discovery options include SecurityTrails (free limited searches) and command-line tools like Subfinder, which aggregate multiple passive sources.

Defender perspective: Organisations monitor CT logs and subdomain lists to catch dangling DNS records (which carry subdomain takeover risk) or unauthorised subdomains."