Osint tool that finds exposed files on domains
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
hey guys, wanted to show one of my side projects i just made public.the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed.it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search.would love to hear if you have other ideas for useful features, and also ideas for how to reduce abuse of the data, since that's the part i'm least sure about.https://search.cerast-intelligence.com/
HN · launched Jul 5, 2026 · 58 upvotes (top 14%) · 0 views
Niche: vulnerability scanning and exploitation tools · 73 launches, 5 in the last 7 days · Explore this niche →
Category and tags
- Security
- Search & retrieval
- Developer
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 73 launches in vulnerability scanning and exploitation tools →
Could you build this?
Partial The UI and basic HTTP scanner are trivial, but continuously consuming the massive real-time stream of Certificate Transparency logs and scanning millions of targets without getting IP-banned requires serious pipeline infra.
What it would actually take: Building a live CT log monitor requires ingesting and parsing Certificate Transparency streams (e.g., via Certstream or RFC 6962 APIs) handling tens of millions of certs daily. It demands a distributed async worker pool (Go/Rust, Redis/Kafka) with proxy rotation, rate-limiting, and error-handling to probe HTTP endpoints (.env, .git/HEAD) without triggering abuse blocks.
Discussion
20 comments analyzed.
Competitors mentioned: Leakix.net, Shodan
Concerns raised: Crawling sites without consent is abusive and malicious, Server hammering from constant scanning requests, Potential legal trouble with government sites, Exposes sensitive information like credentials and proprietary data
Feature requests: Opt-in scanning model instead of proactive crawling, Better visibility into which businesses use the tool
Competitors
Other products that read as similar to this one : 314 launches clear the similarity bar, closest 8 shown.
Attention rank: #40 of 315 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 246 days after the earliest competitor.
- footprint-osint · github · 2026-09-20 · 18 upvotes · similarity 0.56
- I built a search engine for all domains on the internet · hn · 2025-11-07 · 5 upvotes · similarity 0.55
- SpiderFoot OSINT Tool · ph · 2026-10-01 · 1 upvotes · similarity 0.53
- VoidAccess · hn · 2026-10-20 · 188 upvotes · similarity 0.53
- MailAccess · hn · 2026-10-06 · 75 upvotes · similarity 0.48
- DotenvScan · ph · 2026-10-17 · 1 upvotes · similarity 0.48
- SpiderFoot · ph · 2026-10-01 · 1 upvotes · similarity 0.48
- Roso.info · ph · 2026-09-19 · 2 upvotes · similarity 0.46
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.