{"id":13633329,"url":"https://github.com/glebarez/cero","last_synced_at":"2025-04-12T23:28:04.431Z","repository":{"id":37678770,"uuid":"259044249","full_name":"glebarez/cero","owner":"glebarez","description":"Scrape domain names from SSL certificates of arbitrary hosts","archived":false,"fork":false,"pushed_at":"2024-03-31T02:21:34.000Z","size":41,"stargazers_count":640,"open_issues_count":4,"forks_count":84,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-04-05T22:03:06.793Z","etag":null,"topics":["domain-names","recon","scrape","ssl","tls","websecurity"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/glebarez.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-26T13:58:56.000Z","updated_at":"2025-04-05T08:01:45.000Z","dependencies_parsed_at":"2024-01-14T08:54:49.374Z","dependency_job_id":"d7ef062e-4990-4bd3-bdc3-0c1995b97da8","html_url":"https://github.com/glebarez/cero","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glebarez%2Fcero","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glebarez%2Fcero/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glebarez%2Fcero/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/glebarez%2Fcero/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/glebarez","download_url":"https://codeload.github.com/glebarez/cero/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248646454,"owners_count":21139008,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["domain-names","recon","scrape","ssl","tls","websecurity"],"created_at":"2024-08-01T23:00:33.703Z","updated_at":"2025-04-12T23:28:04.411Z","avatar_url":"https://github.com/glebarez.png","language":"Go","readme":"![](https://img.shields.io/github/go-mod/go-version/glebarez/cero) ![](https://img.shields.io/codecov/c/github/glebarez/cero) [![build](https://github.com/glebarez/cero/actions/workflows/create-release.yaml/badge.svg)](https://github.com/glebarez/cero/actions/workflows/create-release.yaml)\n\n# cero\nCero will connect to remote hosts, and read domain names from the certificates provided during TLS handshake. \u003cbr\u003e\nIt is not limited to only HTTPS, and will scrape certificates from any protocol that works over TLS (e.g. SMTPS) - just give it the right ports to connect to.\u003cbr\u003e\nCero allows flexible specification of targets, including domain names, IP addresses, and CIDR ranges, with full support for IPv6.\n\n## Installation / Update\n- Download pre-compiled binary for your OS from [Latest release](https://github.com/glebarez/cero/releases/latest)\n- alternatively, compile from source:\n```bash\ngo install github.com/glebarez/cero@latest\n```\n\n## Usage examples\nConnect to remote host using its domain name and default port (443)\n```bash\n▶ cero yahoo.com\n*.www.yahoo.com\n*.yahoo.com\nyahoo.com\n*.amp.yimg.com\nmbp.yimg.com\n*.att.yahoo.com\nadd.my.yahoo.com\nca.my.yahoo.com\nca.rogers.yahoo.com\nddl.fp.yahoo.com\nfr-ca.rogers.yahoo.com\nhk.rd.yahoo.com\ntw.rd.yahoo.com\n```\nNOTE: You might want to use the **-d** option to automatically strip invalid domain names (e.g. wildcards, bare IPs and usual gibberish) to integrate this tool more smoothly into your recon pipelines.\n\nCero is fast and concurrent, you can pipe your inputs into it. The concurrency level can be set with **-c** flag:\n```bash\ncat myTargets.txt | cero -c 1000\n```\nyou can define list of default ports to connect to, with **-p** option:\n```bash\ncat myTargets.txt | cero -p 443,8443\n```\nCero will accept bare IP as input:\n```bash\ncero 10.0.0.1\n```\nOr a CIDR range\n```bash\ncero 10.0.0.1/22\n```\nIPv6 is fully supported\n```bash\ncero 2a00:b4c0::/102\n```\nyou can use specific port for every target\n```bash\ncero 10.0.0.1:8443 [2a00:b4c0::1]:10443\n```\nPort specification is even supported on CIDR ranges:\n```bash\ncero 192.1.1.1/16:8443\n```\n```bash\ncero 2a00:b4c0::/102:8443\n```\nHere is mass-scraping example for popular TLS ports across entire CIDR range:\n```\ncero -p 443,4443,8443,10443 -c 1000 192.0.0.1/16\n```\n\n## Output control\nBy default, cero will only output successfully scraped domain names as simple list (to standard output), and the errors (if any)  will be suppressed.\u003cbr\u003e\nIf you want to see detailed output for every host, use the **-v** flag. This will format output a little differently, and also write error messages to standard error.\n```bash\n▶ cero -v example.com example.com:80\nexample.com:80 -- tls: first record does not look like a TLS handshake\nexample.com:443 -- [www.example.org example.com example.edu example.net example.org www.example.com www.example.edu www.example.net]\n```\nFor precise controls, use shell redirects:\n```\n▶ cero -v example.com example.com:80 2\u003e/dev/null\nexample.com:443 -- [www.example.org example.com example.edu example.net example.org www.example.com www.example.edu www.example.net]\n```\n\n## Note on port specification in IPv6 addresses\nText representation of IPv6 address by design contains semicolons (see RFC4291), thus to specify the port you must enclose the host address in square brackets, e.g.:\n```\n[ff:23::43:1]:443\n```\nThough this is not mandatory (at least for cero)\u003cbr\u003e\nIn unambiguous cases cero will correctly split the host and port, even when square brackets are not used.\u003cbr\u003eIn truly ambiguous cases, cero will parse the whole input as IPv6 address.\n\n## Full option list\n```console\nusage: cero [options] [targets]\nif [targets] not provided in commandline arguments, will read from stdin\n\noptions:\n  -c int\n        Concurrency level (default 100)\n  -d    Output only valid domain names (e.g. strip IPs, wildcard domains and gibberish)\n  -p string\n        TLS ports to use, if not specified explicitly in host address. Use comma-separated list (default \"443\")\n  -t int\n        TLS Connection timeout in seconds (default 4)\n  -v    Be verbose: Output results as 'addr -- [result list]', output errors to stderr as 'addr -- error message'\n  ```\n","funding_links":[],"categories":["Recon","Go"],"sub_categories":["Subdomain Enumeration"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglebarez%2Fcero","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fglebarez%2Fcero","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglebarez%2Fcero/lists"}