Oneliner Subdomain Enumeration! 🌏 | Infosecwithme

Oneliner Subdomain Enumeration! 🌏 | Infosecwithme

Run this nifty little command to grab a neat list of subdomains under a given TLD:

curl 'https:​//crt​.sh/?q=%.example​.com&output=json' | jq '.name_value' | sed 's/\"//g' | sed 's/\*\.//g' | sort -u

Thanks to @NahamSec


REFINED VERSION - a bit shorter and more efficient as it uses the -r flag in jq to cut out the double piping to sed:

curl 'https:​//crt​.sh/?q=%.example​.com&output=json' | jq -r '.name_value' | sed 's/\*\.//g' | sort -u

(🙏🏽 to @fharding0 for the -r tip)


#oneliner #enumeration