Here is how anyone can unwrap the organization’s internal tools/products that no one is supposed to know about.

Typically, in software organizations, most of us don’t want to share internal applications on the internet, but we unintentionally share application names by requesting certificates. The issued certs get into the Certificate Transparency (CT) logs https://certificate.transparency.dev/, which are a Merkle tree that allows the rest of the world to see them. With this, anyone can access internal finance, upcoming products that had code names, etc.

IMO, one of the easiest ways for folks to get CT logs for any given domain is to use something like https://sslmate.com/help/reference/certspotter_authorization_api (this API provides a throttled, free tier), which provides all the certificate entries (and believe me, lots of these domains are open on the public internet). Think of this like Shodan, but instead of searching with an IP or CIDR range, the bad actor can use a name. Once they get the hostnames, they can start searching for vulnerabilities or open applications.

Getting the DNS is just the start; from there, they can check whether it is available on the internet, look for weak cookies, CORS checks, dump the JS bundles, and look for open API endpoints. (There are often API endpoints left open without any authentication.

Fetching all the above data does not require an LLM, since these are deterministic. There are easily available tools like https://github.com/g0ldencybersec/gungnir that actively monitor CT logs for new certificates and can provide information in a matter of seconds when a new hostname pops up. Even a not-so-motivated actor can also use this data, along with the help of an LLM, to cause some significant impact on your systems.

Gungnir monitoring CT logs for newly issued certificates

With the advent of AI Slop, many of these applications get built and left open on the internet, and it has been observed that many dev/staging environments are open. For a motivated actor, crossing the threshold into other areas is not impossible.

If your organization has a private PKI, then you already know what to do. If not, the easiest fix is to get a wildcard cert like *.internal.foo.com which can reduce the blast radius.

If there is one thing to walk away with after reading this post, it is to go and check the CT logs for the domains you are interested in ;)