Find Hidden Subdomains

Find Hidden Subdomains is an Automation skill for Claude Code, published by useosint in osint-skills.

12 stars1 forkson useosint/osint-skillsAdded 2026/08/12+200% in starsRepository updated 2026/08/03

agent-skillsai-agentsclaudeclaude-skillscursorcursor-skillscybersecuritydigital-forensicsdue-diligencegeointinformation-gatheringinfosecinvestigationopen-source-intelligenceosintosint-toolspentestingreconnaissancesocmintthreat-intelligence

Install in seconds

Install Find Hidden Subdomains

Copy Find Hidden Subdomains into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/useosint/osint-skills/tree/main/skills/find-hidden-subdomains ~/.claude/skills/find-hidden-subdomains

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/useosint/osint-skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/find-hidden-subdomains/SKILL.md in useosint/osint-skills
Installs to: ~/.claude/skills/find-hidden-subdomains
Collection: One of 25 skills cataloged from this repository
Category: Automation — 1523 skills

What Find Hidden Subdomains does

Find Hidden Subdomains enumerates an organization’s subdomains and sibling domains from Certificate Transparency logs and passive DNS without sending traffic to the target. Use it to map hostnames, find staging or admin systems, and spot newly issued certificates.

Find Hidden Subdomains is cataloged under Automation on DirSkills. Find Hidden Subdomains comes from a repository tagged agent-skills, ai-agents, claude, claude-skills and cursor.

Documentation

README

Excerpt

Find hidden subdomains

The hosts an organization forgot about are the ones worth finding, and most of them announced themselves the moment someone requested a TLS certificate. Certificate Transparency turns that into a searchable, permanent, historical index — free and completely passive. The beginner's mistake is treating a CT hit as a live host: most of what you pull back does not resolve, and that is information too, not noise.

Which source first

This is the opening of the README. Read the full README on GitHub.

Frequently asked about Find Hidden Subdomains

What else does useosint publish alongside Find Hidden Subdomains?
Find Hidden Subdomains is one of 25 skills that DirSkills catalogs from useosint/osint-skills, the repository it ships in. Its siblings there include Dig Through Data Brokers, Find Anyone and Find Exposed Servers. Each one is a separate skill with its own page in this directory, installs the same way Find Hidden Subdomains does, and is maintained by useosint in that same repository. The rest of the collection is listed on the useosint/osint-skills page.
How does Find Hidden Subdomains compare to other Automation skills?
Find Hidden Subdomains ranks #1510 by stars among the 1523 Automation skills in this catalog. The most-starred ones next to it are Autonomous Loops, Autonomous Agent Harness and Automation Audit Ops. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Find Hidden Subdomains against them. Open each page to compare what they document and how they install.