██████╗██████╗ ████████╗███╗   ██╗██████╗ ███████╗████████╗██████╗ ██╗   ██╗
██╔════╝██╔══██╗╚══██╔══╝████╗  ██║██╔══██╗██╔════╝╚══██╔══╝██╔══██╗╚██╗ ██╔╝
██║     ██████╔╝   ██║   ██╔██╗ ██║██║  ██║███████╗   ██║   ██████╔╝ ╚████╔╝ 
██║     ██╔══██╗   ██║   ██║╚██╗██║██║  ██║╚════██║   ██║   ██╔══██╗  ╚██╔╝  
╚██████╗██║  ██║   ██║   ██║ ╚████║██████╔╝███████║   ██║   ██║  ██║   ██║   
 ╚═════╝╚═╝  ╚═╝   ╚═╝   ╚═╝  ╚═══╝╚═════╝ ╚══════╝   ╚═╝   ╚═╝  ╚═╝   ╚═╝   

Description

crtndtry uses a number of different sources to create a list of root subdomains (i.e.: corp.example.com)

Usage

./crtndstry example.com

Sources

• crt.sh - requires using different patterns as shown in the source
• digiCert
• certspotter

Video

Here's the VOD of me writing this tool during one of my streams https://youtu.be/o37L5n6w9BQ

Credits

• nukedx
• dmfroberson