4 ms·
This is certificate transparency doing most of the work, right?
by RockRobotRock 3y ago
This is certificate transparency doing most of the work, right?
- out-of-ideas 3y agoit may utilize a few techniques as there are subdomains I am aware of that've never been published other than in the zone config on my registrar that are returned from api query
- pbhjpbhj 3y agoI use Siteground and it has a staging server that AFAIK hasn't been used for at least 6 years ... Nothing at the host has any details of that, archive.org doesn't have it in their site URLs, it's not in DNS records, not in .well-known, it was a transient test years ago ... really curious, must be historic data from somewhere?
- RockRobotRock 3y agoI use Cloudflare for DNS and the only ones it found had LE certs. It's not doing a simple brute-force on common names, I don't think. Otherwise it probably would have found a lot more. Curious about how it works.
- zootboy 3y agoI would assume so. I tested on one of my private domains that generally isn't linked to anywhere, and it just returned the few domains that I generate Let's Encrypt certs for, plus my nameservers. Interestingly, I did not receive any DNS queries on my authoritative nameservers during the query, so they don't seem to be doing any active DNS probes.