franccesco / getaltname

Extract subdomains from SSL certificates in HTTPS sites.
https://franccesco.github.io/getaltname/
MIT License
364 stars 74 forks source link

[Feature request] Check if domain is available #13

Closed ghost closed 4 years ago

ghost commented 4 years ago

Hi there,

I would like a feature that isn't available right now.

I would like to know of the subdomains are available or not. Lot of subdomains returned by gsan crtsh <domain> are unavailable and contains old data.

Do you think you can/want to add this?

Example:

PS C:\Users\leon> gsan crtsh zeznzo.nl
[+] Getting subdomains for zeznzo.nl
[+] Results:
              ZEZNZO.NL      STATUS
1     grafana.zeznzo.nl      200
2             zeznzo.nl      200
3     raasnet.zeznzo.nl      200
4     ssltest.zeznzo.nl      Time-out
5   jobhunter.zeznzo.nl      Time-out
6     crawler.zeznzo.nl      Time-out
7      kibana.zeznzo.nl      Time-out
8      ntopng.zeznzo.nl      Time-out
9      webmin.zeznzo.nl      Time-out
10      wekan.zeznzo.nl      200

I hope to hear from you.

franccesco commented 4 years ago

I have think about this a lot and although it is possible to implement this feature detecting if a host is alive is not within the scope of this tool. The reason is because the main purpose of the program is to identify domains or sub-domain names attached to that SSL certificate found in a HTTPS service.

Whether they are alive or not might be very dependent on many factors on that service, they might not be reachable because they are behind a firewall, or you need to login into an internal network first, or maybe they're just turned off.

To achieve this there are plenty of tools that can help with scanning and monitoring (Nmap is a great example). So, even though it would be interesting to see the status of each host, there are tools that can already do this much better for you.