Certified Ethical Hacker (CEH) Practice Question

Certificate transparency (CT) logs publicly record the vast majority of browser-trusted TLS certificates that certificate authorities issue, though a few exclusions still exist. Because each certificate lists the fully qualified domain names it secures-now placed primarily in the Subject Alternative Name field-searching CT data is an efficient way to uncover additional hostnames for a target organization. The crt.sh web interface is purpose-built for querying CT logs, enabling an assessor to pull all certificates (and therefore subdomains) related to a domain with a single search. A Google site: query relies on what content the search engine has crawled and often misses hosts that never serve indexable pages. Netcat probing of port 443 without specifying an SNI value reveals only the default certificate, not the many additional names on other virtual hosts. Wappalyzer focuses on identifying technology stacks of pages you already know about and does not enumerate unseen subdomains. Consequently, crt.sh is the most effective resource for this reconnaissance step.