Technical OSINT Fundamentals

Code Examples: Capture Certificate and Web Metadata

Connecting to LMS... Progress: in progress

Code Examples

Collect Certificate Transparency Names for Scope Review

# Replace example.org only with an approved domain from the case scope.
domain="example.org"
curl --silent --get "https://crt.sh/" \
  --data-urlencode "q=%.$domain" \
  --data-urlencode "output=json" \
  --max-time 15 > "ct-$domain.json"

Extract Unique Hostnames from CT Results

import json


with open("ct-example.org.json", encoding="utf-8") as source:
    entries = json.load(source)

names: set[str] = set()
for entry in entries:
    for name in str(entry.get("name_value", "")).splitlines():
        normalized = name.lower().lstrip("*.").rstrip(".")
        if normalized.endswith(".example.org"):
            names.add(normalized)

for name in sorted(names):
    print(name)

Preserve Header and Redirect Context

url="https://www.example.org/"
stamp="$(date -u +%Y%m%dT%H%M%SZ)"

curl --silent --show-error --location --head \
  --max-redirs 5 \
  --max-time 10 \
  --dump-header "headers-$stamp.txt" \
  --output /dev/null \
  "$url"