3 ms·
Just try it. The first example gets attacked by bots nearly immediately after issuing a TLS cert. The second one usually doesn't get detected at all.
by andix 9mo ago
Just try it. The first example gets attacked by bots nearly immediately after issuing a TLS cert. The second one usually doesn't get detected at all.
- Kwpolska 9mo agoWhat if you have a wildcard cert for *.example.com?
- andix 9mo agoMuch better. But you still leave traces from dns queries. Subfinder has a lot of sources to find subdomains, not only certs: https://github.com/projectdiscovery/subfinder https://github.com/projectdiscovery/subfinder
- jamesfinlayson 9mo agoI worked at a company where the security team disliked wildcard certificates because it exposed us to the risk of someone, somehow, hosting something malicious on a subdomain.