{"id":37896205,"url":"https://github.com/recon-tools/domain-recon-rs","last_synced_at":"2026-01-16T17:00:58.167Z","repository":{"id":63851622,"uuid":"526969530","full_name":"recon-tools/domain-recon-rs","owner":"recon-tools","description":"Discover domain names based on SSL certificates.","archived":false,"fork":false,"pushed_at":"2024-12-18T09:59:02.000Z","size":3097,"stargazers_count":12,"open_issues_count":1,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-12-18T10:37:11.512Z","etag":null,"topics":["bugbounty","dns","reconnaissance","rust-lang"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/recon-tools.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-20T15:45:18.000Z","updated_at":"2024-12-18T09:46:28.000Z","dependencies_parsed_at":"2024-12-18T10:31:51.495Z","dependency_job_id":"121e0c99-a23a-46f8-b6b1-c7acac23d424","html_url":"https://github.com/recon-tools/domain-recon-rs","commit_stats":null,"previous_names":[],"tags_count":26,"template":false,"template_full_name":null,"purl":"pkg:github/recon-tools/domain-recon-rs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/recon-tools%2Fdomain-recon-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/recon-tools%2Fdomain-recon-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/recon-tools%2Fdomain-recon-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/recon-tools%2Fdomain-recon-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/recon-tools","download_url":"https://codeload.github.com/recon-tools/domain-recon-rs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/recon-tools%2Fdomain-recon-rs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28480081,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T11:59:17.896Z","status":"ssl_error","status_checked_at":"2026-01-16T11:55:55.838Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bugbounty","dns","reconnaissance","rust-lang"],"created_at":"2026-01-16T17:00:55.261Z","updated_at":"2026-01-16T17:00:58.149Z","avatar_url":"https://github.com/recon-tools.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# domain-recon-rs\n\n## Intro\n\n`domain-recon-rs` is a tool which can be used for passive host reconnaissance. It helps extend the attack surface by\nfetching all the available active certificates for the host. Using certificate parsing, it extracts\nall available domains from \"Common Name\" and \"Matching Identities\" fields.\nMoreover, in a lot of cases, it may encounter certificates issued for wildcard domains (example: `*.example.com`).\nFor these domains, it can use a word list to extend these wildcards by filling in words from the list and generate\npotential subdomains.\n\nFor more information, please read the blogpost: [https://ervinszilagyi.dev/articles/certificate-parsing-with-domain-recon](https://ervinszilagyi.dev/articles/certificate-parsing-with-domain-recon)\n\n### Example of usage:\n\n```bash\ndomain-recon -d wikipedia.org -f words.txt\n```\n\n**Note**: an example of [`words.txt`](words.txt) can be found here: [https://raw.githubusercontent.com/recon-tools/domain-recon-rs/main/words.txt](https://raw.githubusercontent.com/recon-tools/domain-recon-rs/main/words.txt)\n\n![Example of usage GIF](images/example.gif)\n\nCurrently, certificates are fetched from [crt.sh](https://crt.sh/), [censys](https://search.censys.io/api) \nand [certspotter](https://sslmate.com/ct_search_api/). By default, `domain-recon` will use crt.sh only, \ncensys and certspotter being additional options. In order to use censys or certspotter, we have to provide a \nconfiguration file, that contains our API credentials. `domain-recond` reads this information from \nthe `$HOME/.config/domain-recon/config.json` folder. The structure of this file should be as follows:\n\nconfig.json\n```json\n{\n    \"censys\": [\n        {\n            \"app-id\": \"84f2fe92-9c4e...\",\n            \"secret\": \"bmwjq....\"\n        }\n    ],\n    \"certspotter\": [\n        {\n            \"api-key\": \"k47370_...\"\n        }\n    ]\n}\n```\n\n### All the Arguments\n\n```bash\n$ domain-recon -h\nExtract domains and subdomains from certificates.\n\nUsage: domain-recon [OPTIONS] --domain \u003cDOMAIN\u003e\n\nOptions:\n  -d, --domain \u003cDOMAIN\u003e\n          Domain name to be scanned\n  -f, --file \u003cFILE\u003e\n          Optional path to a words file used for expand wildcard domains. If there is no path provided, there will be no attempt to expand wildcard domains\n  -p, --plain\n          Display results in plain form (no banner, no color)\n      --domains-only\n          Display a plain list with domain names only\n      --ips-only\n          Display a plain list with unique IP addresses only\n      --csv\n          Save output to csv\n      --use-system-resolver\n          Use default system DNS resolver\n      --dns-resolver \u003cDNS_RESOLVER\u003e\n          Specify a remote DNS resolver. Allowed values are: google, cloudflare, quad9. Default is google .Can contain multiple values delimited by comma, ex --dns-resolver=\"google,cloudflare,quad9\" [default: google]\n      --provider \u003cPROVIDER\u003e\n          Certificate provider. Allowed values are: certsh, censys, certspotter. Default is certsh. Can contain multiple values delimited by comma, ex --provider=certsh,censys,certspotter [default: certsh]\n  -c, --config \u003cCONFIG\u003e\n          Optional path to config file. If no path is given, certificate providers such as censys or certspotter can not be used\n  -n, --number-of-parallel-requests \u003cNUMBER_OF_PARALLEL_REQUESTS\u003e\n          Number of maximum parallel requests when doing DNS resolution [default: 10]\n  -h, --help\n          Print help information\n  -V, --version\n          Print version information\n```\n\n## Download and Install\n\n### Ubuntu/Debian\n\n- Add the following PPA:\n\n```bash\ncurl -s --compressed -L \"https://recon-tools.github.io/ppa/debian/KEY.gpg\" | sudo apt-key add -\nsudo curl -s --compressed -L -o /etc/apt/sources.list.d/recon_tools.list \"https://recon-tools/ppa/debian/recon_tools.list\"\nsudo apt update\n```\n\n- Install using `apt-get`:\n\n```\nsudo apt install domain-recon\n```\n\n### MacOS\n\nRun the following commands:\n\n```bash\nbrew tap recon-tools/homebrew-recon-tools\nbrew install domain-recon-rs\n```\n\n### Windows\n\nWe can download the executable from the releases page: [https://github.com/recon-tools/domain-recon-rs/releases](https://github.com/recon-tools/domain-recon-rs/releases)\nMake sure we choose the right executable for our OS/architecture.\n\nOr we can simply build the project.\n\n## Building the Project\n\nThis project requires **Rust 1.83** or above.\n\n```bash\ncd domain-recon-rs\ncargo build --release\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frecon-tools%2Fdomain-recon-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frecon-tools%2Fdomain-recon-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frecon-tools%2Fdomain-recon-rs/lists"}