Forgotten Subdomains curl -s "https://crt.sh/?q=%25.target.com&output=json" -H "User-Agent: Mozilla/5.0" | jq -r '.[].name_value' 2>/dev/null | sed 's/*.//g' | tr 'A-Z' 'a-z' | sort -u Certificate Transparency: Anything that ever got an SSL …