██████╗██████╗ ████████╗███╗   ██╗██████╗ ███████╗████████╗██████╗ ██╗   ██╗
██╔════╝██╔══██╗╚══██╔══╝████╗  ██║██╔══██╗██╔════╝╚══██╔══╝██╔══██╗╚██╗ ██╔╝
██║     ██████╔╝   ██║   ██╔██╗ ██║██║  ██║███████╗   ██║   ██████╔╝ ╚████╔╝ 
██║     ██╔══██╗   ██║   ██║╚██╗██║██║  ██║╚════██║   ██║   ██╔══██╗  ╚██╔╝  
╚██████╗██║  ██║   ██║   ██║ ╚████║██████╔╝███████║   ██║   ██║  ██║   ██║   
 ╚═════╝╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═══╝╚═════╝ ╚══════╝   ╚═╝   ╚═╝  ╚═╝   ╚═╝   

Description

crtndtry uses a number of different sources to create a list of root subdomains (i.e.: corp.example.com)

Usage

./crtndstry example.com

Sources

• [crt.sh] (https://crt.sh) - requires using different patterns as shown in the source
• [digiCert] (https://ssltools.digicert.com)
• [certspotter] (https://certspotter.com)

Video

Here's the VOD of me writing this tool during one of my streams

Credits

• nukedx
• dmfroberson