Question 1

How do I find all subdomains of a domain?

Accepted Answer

Enter the root domain (e.g., example.com) into the ShieldScope /exposure tool. It queries certificate transparency logs, which are public records published by certificate authorities for every TLS certificate ever issued. This gives comprehensive subdomain coverage without any active scanning or probing of the target domain.

Question 2

What is external attack surface management (EASM)?

Accepted Answer

External attack surface management (EASM) is the practice of continuously discovering and assessing internet-facing assets that could be targeted by attackers � subdomains, exposed services, VPN gateways, admin panels, and development systems. ShieldScope's /exposure tool performs passive EASM analysis using certificate transparency logs and HTTP fingerprinting, classifying each discovered host by function and risk level.

Question 3

Is subdomain discovery legal without permission?

Accepted Answer

Yes. Certificate transparency logs are public records accessible to anyone. Reading them to discover subdomains is entirely passive � no requests are made to the target organization's systems during discovery. ShieldScope's /exposure tool then makes standard HTTPS requests to discovered hosts, which is identical to what a browser would do. This is passive reconnaissance on publicly available data, which is legal in all standard jurisdictions.

Question 4

How does certificate transparency subdomain discovery work?

Accepted Answer

Certificate authorities are required to publish every TLS certificate they issue to public certificate transparency logs. These logs contain the domain names (and subdomains) covered by each certificate. By querying these logs, it's possible to enumerate a large portion of a domain's subdomains without making any requests to the target � because the data is already public in the CT log infrastructure.

Subdomain Finder & External Attack Surface Analyzer