Skip to content
Extract subdomains from SSL certificates in HTTPS sites.
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
assets add relevant screenshots, bump version number and coverage exclusions Jul 6, 2018
docs patch vulnerable gems Nov 10, 2018
.coveragerc add relevant screenshots, bump version number and coverage exclusions Jul 6, 2018
.gitignore remove heroku dependencies May 10, 2018
.travis.yml fix unit test with gsan unable to scan Feb 21, 2019 add license information Mar 11, 2018
Pipfile.lock update urllib3 package CVE-2019-11324 Apr 19, 2019 add pypi badges Aug 23, 2018 restricts python version to 3.4 and up. Jul 16, 2018

GSAN (Get Subject Alternative Names)

PyPI - Python Version PyPI Build Status Coverage Status GitHub license

GSAN (Get Subject Alternative Names) is a tool that can extract Subject Alternative Names found in SSL Certificates directly from HTTPS web sites which can provide you with DNS names (subdomains) or virtual servers.

This tool extract subdomain names from https sites and return a list or json output of its findings. It is not a subdomain brute-force tool, and you can actually find those subdomains manually, this tools is about the automation of that process, it also offers the following features:

  • Input a single host or Nmap XML file to scan and return subdomains.
  • List or JSON output, useful if you want to export data into other tools.
  • You can optionally filter out domain names that doesn't match the domain name that you're analyzing.
  • Integration with so you can extract more subdomains from certificates of the same entity.
  • Also works with Self-signed certificates.
  • Copy to your clipboard the domain names as a list or string if you don't want to deal with files, this is also useful for tools that doesn't accept file input.

You can read more about how this tool works from my post in (in Spanish).


     ██████╗    ███████╗    █████╗    ███╗   ██╗
    ██╔════╝    ██╔════╝   ██╔══██╗   ████╗  ██║
    ██║  ███╗   ███████╗   ███████║   ██╔██╗ ██║
    ██║   ██║   ╚════██║   ██╔══██║   ██║╚██╗██║
    ╚██████╔╝██╗███████║██╗██║  ██║██╗██║ ╚████║
     ╚═════╝ ╚═╝╚══════╝╚═╝╚═╝  ╚═╝╚═╝╚═╝  ╚═══╝

       Get - Subjective - Alternative - Names

usage: gsan [-h] [-p PORT] [-s [timeout]] [-m] [-q] [-o OUTPUT]
                   [-f {json,text}] [-c {l,s}] [-d] [-V]

positional arguments:
  hostname                              Host or Nmap XML to analyze.

optional arguments:
  -h, --help                            show this help message and exit
  -p PORT, --port PORT                  Destiny port (default 443)
  -s [timeout], --search-crt [timeout]  Retrieve subdomains found in
  -m, --match-domain                    Matching domain names only
  -q, --quiet                           Supress output.
  -o OUTPUT, --output OUTPUT            Set output filename
  -f {json,text}, --format {json,text}  Set output format
  -c {l,s}, --clipboard {l,s}           Copy the output to the clipboard as a
                                        List or a Single string
  -d, --debug                           Set debug enable
  -V, --version                         Print version information.


In this case the tool give you sub-domains that you probably didn't find with a sub-domain brute force tool.

Example Image


Disclaimer: The tool was renamed from getaltname to GSAN. asciicast


$ pip install --user gsan


  • File output
  • Output to clipboard
  • Clean sub-domains wildcards
  • Remove duplicates
  • A filter system for main domain and TLD's.
  • Add colors (so l33t. /s)
  • Get additional sub-domains from
  • Read Nmap XML and analyze them
  • JSON Output
  • Unit Tests
  • Coverage Reports


Contribution Guidelines

Contribution is welcome, just remember:

  • Fork the repo.
  • Make changes to the develop branch.
  • Make a Pull Request.

Support this project

If you like the project and would like to support me you can buy me a cup of coffee, you will also be inmortalized as a patreon, thank you 🙏

Buy Me A Coffee Buy Me a Coffee at
You can’t perform that action at this time.