Technical note
Your certificates already published your subdomain inventory
Every TLS certificate you are issued is written to a public, append-only log. An attacker's first move is to read it. The Attack Surface Mapper reads the same log and triages it — without scanning a port or guessing a name.
· 2 min read · written from the shipped implementation
What the log is
Certificate Transparency requires certificate authorities to submit every certificate they issue to public logs. Browsers refuse certificates that carry no proof of logging, so the requirement is universal in practice. The consequence is rarely stated plainly: the hostnames in every certificate an organisation has ever requested are public, permanent and searchable.
That includes the hostnames nobody meant to advertise — a staging environment issued a certificate for a demo, an internal admin console fronted by a public load balancer, a build system that was reachable for a week. The certificate outlived the reason for it.
What an attacker does with it
Reconnaissance starts with inventory, and the log hands it over. The interesting entries are not the well-known ones; they are the hostnames whose DNS now points somewhere the organisation no longer controls. A record that delegates to a third-party service which has since been released is the subdomain-takeover shape: whoever registers the released name next serves content on your domain, inside your cookies, with a certificate a browser trusts.
What the tool does, and refuses to do
The Attack Surface Mapper reads the log for a domain and triages the result into the shapes that matter: delegations to services that no longer answer, administrative and pre-production names that were never meant to be public, and private addresses that leaked into public DNS.
It is entirely passive. No port is scanned, no hostname is guessed, no host is connected to, and a takeover is reported but never attempted. The distinction is not a courtesy: active probing of infrastructure a free tool has no authorization to touch is exactly the behaviour the responsible-testing policy forbids, and a tool that did it would be teaching visitors to do the same.
- Read: the public certificate log for the domain.
- Inferred: which hostnames delegate to an absent third party, which look administrative or pre-production, which resolve to private space.
- Refused: port scans, hostname brute force, connections to any listed host, takeover attempts.
What a clean result means
A short list is evidence about the log, not about the organisation. Hostnames that never had a certificate are invisible here, and the tool says so in its limitations rather than letting silence imply completeness. An authorized external penetration test is the way to know what the log cannot show.