Map an organisation's infrastructure
The whole point is to stay in passive reconnaissance : you query third parties that already collected the data, never the target itself. Certificates are the most productive starting point, because an issued certificate is public and often names hosts the organisation never published.
The tools, in order
- 01
Every certificate issued for a domain, including internal hosts named by mistake
CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.
- 02Amass (T)free
Aggregates dozens of passive sources into a single subdomain enumeration
Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.
- 03DNS Dumpsterfree
An immediate overview in the browser, with nothing to install
Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.
- 04Shodanfreemium
Says what actually runs on each address found, from scans already performed
Search engine for internet-exposed devices, services, and security-relevant banners.
- 05Censysfreemium
Cross-references certificates and hosts, and catches what Shodan misses
Internet-wide scanner and search engine for hosts, certificates, and services.
- 06SpiderFoot (T)free
Chains all these sources automatically and keeps a record of every finding
Automated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.
The pitfall to avoid
A subdomain that resolves does not necessarily belong to the organisation. Shared hosting, suppliers and former subsidiaries produce results that have not been theirs for years. Check who owns the address block before attributing a host.
🧭 The full plan
The copilot orders every step from your starting point, with pre-filled queries.
📖 The guides
Detailed methods by investigation type.