Find a website's hidden pages

A company's homepage shows you what it wants you to see. But most companies have a whole other set of pages that aren't linked from the menu anywhere. A customer login. A status page. An old microsite they forgot about. That's often where the interesting stuff lives. The technical name for hunting these down is subdomain enumeration, and it's easier than it sounds.

Here's the surprising part: companies publish a list of these pages themselves, usually without realizing it. You just have to know where the list is.

The free public record

Every time a website turns on the little padlock in your browser (the security certificate), that gets written into a public log. The web address is right there in the log. So every company has basically published a list of its own pages, one entry at a time, every time it secured one. There's a free site that lets you search this log. One look, dozens of pages, no cost.

Then fill in the gaps

The log misses a few. You can catch the rest by checking the obvious guesses. Most companies use the same predictable names for their hidden pages (login, app, help, careers, and so on). You run down a list of common ones and keep the ones that actually exist. There are free tools that do this whole step for you.

Keep only the live ones

A page being listed doesn't mean it's still up. The last step is a quick knock on each door to see which ones answer. What's left is a real map of the company's web presence, including the parts that aren't in any menu.

A word on staying clean

Done right, this is just reading public records and knocking politely to see what's open. It's the same first step a security researcher takes, pointed at finding information instead of weaknesses. Don't go poking at anything that's clearly meant to be private, and you're on solid ground.