Subdomain discovery
subdomainsPassive subdomain discovery from Certificate Transparency logs (crt.sh): finds hostnames that appeared in public TLS certificates, not every DNS record. crt.sh is occasionally slow or unavailable.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"domain": "<domain>"
},
"name": "subdomains"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain to passively discover subdomains for via Certificate Transparency logs, e.g. example.com. |