An open source intelligence tool to crawl the graph of certificate Alternate Names
An open source intelligence tool to crawl the graph of certificate Alternate Names
CertGraph crawls SSL certificates creating a directed graph where each domain is a node and the certificate alternative names for that domain's certificate are the edges to other domain nodes. New domains are printed as they are found. In Detailed mode upon completion the Graph's adjacency list is printed.
Crawling defaults to collecting certificate by connecting over TCP, however there are multiple drivers that can search Certificate Transparency logs.
This tool was designed to be used for host name enumeration via SSL certificates, but it can also show you a "chain" of trust between domains and the certificates that re-used between them.
Blog post with more information
…
CertGraph has multiple options for querying SSL certificates. The driver is responsible for retrieving the certificates for a given domain. Currently there are the following drivers:
http this is the default driver which works by connecting to the hosts over HTTPS and retrieving the certificates from the SSL connection
smtp like the http driver, but connects over port 25 and issues the starttls command to retrieve the certificates from the SSL connection
censys this driver searches Certificate Transparency logs via censys.io. No packets are sent to any of the domains when using this driver. Requires Censys API keys
crtsh this driver searches Certificate Transparency logs via crt.sh. No packets are sent to any of the domains when using this driver
…
The above output represents the adjacency list for the graph for the root domain eff.org. The adjacency list is in the form:
Node Depth Status Cert-Fingerprint
Pre-compiled releases are automatically built and uploaded to the releases GitHub page using GitHub Actions. Releases are available for multiple platforms including Linux, macOS, and Windows.
This project uses GitHub Actions for continuous integration and deployment:
CertGraph is available as Docker image on the GitHub Container Registry
GitHub Container Registry:
docker run --rm -it ghcr.io/lanrat/certgraph example.com
Example output:
example.com
www.example.net
www.example.org
www.example.com
example.org
example.net
example.edu
www.example.edu
To compile certgraph you must have a working Go 1.23 or newer compiler on your system. To compile for the running system compilation is as easy as running make
certgraph$ make
go build -o certgraph certgraph.go
Alternatively you can use go install to install with this one-liner:
go install github.com/lanrat/certgraph@latest
For development, you can build and test the project using the provided Makefile:
# Build the binary
make
# Run tests
make test
# Run linting
make lint
# Build Docker image locally
make docker
A web UI is provided in the docs folder and is accessible at the github pages url https://lanrat.github.io/certgraph/, or can be run from the embedded web server by calling certgraph --serve 127.0.0.1:8080.
The web UI takes the output provided with the -json flag.
The JSON graph can be sent to the web interface as an uploaded file, remote URL, or as the query string using the data variable.
CertGraph can be used to detect BygoneSSL DoS with the following options. CT-DRIVER can be any Certificate Transparency capable driver. Provide all known input domains you own. If any domains you do not own are printed, then you are vulnerable.
certgraph -depth 1 -driver CT-DRIVER -ct-subdomains -cdn -apex [DOMAIN]...
If you want to find a vulnerable site that has a bug bounty, certgraph can be used with the following options and any driver. But you will have better luck with a non Certificate Transparency driver to ensure that the certificates in question are actually in use
certgraph -cdn -dns -apex [DOMAIN]...
And domains that print * Missing DNS for have vulnerable certificates that should be rotated.
No open issues yet, or sync has not completed.