OSINT: Subdomains via crt.sh

import fetch from 'node-fetch'

async function crtsh(domain) {
  const url = `https://crt.sh/?q=${encodeURIComponent('%.' + domain)}&output=json`
  const res = await fetch(url)
  const data = await res.json()
  // crt.sh returns duplicate names; normalize
  const names = new Set()
  for (const row of data) {
    const commonName = (row.name_value || '').replace(/\n/g, '\n').split('\n')
    commonName.forEach((n) => names.add(n.trim()))
  }
  return Array.from(names).sort()
}

crtsh('example.com')
  .then((subs) => console.log(subs.slice(0, 50)))
  .catch((e) => console.error(e))