#!/bin/sh
# sds - subdomain scanner via Certificate Transparency logs (crt.sh)
# Usage: sds <domain>

[ -z "$1" ] && echo "Usage: sds <domain>" && exit 1

domain="$(echo "$1" | sed 's|^https\?://||;s|/.*||' | tr '[:upper:]' '[:lower:]')"

printf "Scanning CT logs for *.%s ...\n\n" "$domain"

curl -sf "https://crt.sh/?q=%25.${domain}&output=json" |
  jq -r '.[].common_name, .[].name_value' 2>/dev/null |
  tr '\n' '\n' |
  sed 's/\r//g' |
  tr '[:upper:]' '[:lower:]' |
  grep -v "^${domain}$" |
  grep "\.${domain}$\|^\*\.${domain}$" |
  sort -u |
  awk -v dom="$domain" '
    /^\*\./ { wild[NR] = $0; next }
    { reg[NR] = $0 }
    END {
      n = 0
      for (i in reg) n++
      for (i in wild) n++
      printf "%d subdomains found for %s\n\n", n, dom
      printf "%-4s  %s\n", "#", "SUBDOMAIN"
      printf "%-4s  %s\n", "---", "---"
      c = 0
      for (i in reg) { c++; printf "%-4d  %s\n", c, reg[i] }
      for (i in wild) { c++; printf "%-4d  %s\n", c, wild[i] }
    }
  '