利用证书透明查询子域名

今天偶然看见了一个利用证书透明来查看子域名的文章，是之前没有见过的方法。

就是说SSL证书颁发机构在颁发证书时会将其域名和子域名公开，利用网上查询接口就可以查询

crt.sh:crt.sh | Certificate Search  查询网站

下面是一个简单的利用脚本，网上找到稍微自己改了一下。

import requests
import concurrent.futures
import argparse

parser = argparse.ArgumentParser(description="利用透明SSL证书查询子域名，使用在线接口:https://crt.sh/?q=cdutetc.cn")
parser.add_argument('-D','--domain',required=True,help="输入域名，不带任何子域，如 baidu.com")
args = parser.parse_args()
def fetch_from_crtsh(domain):
    try:
        url = f"https://crt.sh/?q=%.{domain}&output=json"
        response = requests.get(url)
        if response.status_code == 200:
            return set(cert['name_value'] for cert in response.json() if 'name_value' in cert)
    except Exception as e:
        print(f"Error fetching from crt.sh: {e}")
    return set()

def fetch_from_certspotter(domain):
    try:
        url = f"https://api.certspotter.com/v1/issuances?domain={domain}&expand=dns_names"
        response = requests.get(url)
        if response.status_code == 200:
            return set(name for cert in response.json() for name in cert['dns_names'])
    except Exception as e:
        print(f"Error fetching from CertSpotter: {e}")
    return set()

def main(domain):
    with concurrent.futures.ThreadPoolExecutor() as executor:
        futures = [
            executor.submit(fetch_from_crtsh, domain),
            executor.submit(fetch_from_certspotter, domain)
        ]
        results = set().union(*[future.result() for future in concurrent.futures.as_completed(futures)])
    
    print(f"Found {len(results)} unique subdomains for {domain}:")
    for subdomain in sorted(results):
        print(subdomain)

if __name__ == "__main__":
    print("正在查询{}相关域名".format(args.domain))
    domain = args.domain
    main(domain)

以后多学一点python再改一下吧，感觉有点拉跨。