pq-map 0.2.3

Domain service and cryptography discovery from Certificate Transparency and DNS
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

# pq-map

Discovery and mapping of externally visible cryptographic infrastructure using open source intelligence.

Certificate discovery (crt.sh certwatch DB → HTTP fallback → cache)
→ DNS discovery (SRV/SVCB/HTTPS, A/AAAA)
→ live TLS probing (PQ/hybrid-first via rustls, OpenSSL fallback)
→ correlated text, JSON, and graph output.



https://github.com/user-attachments/assets/1206db15-1b80-4d56-8a4f-e2165bc9b3ae



`pq-map` correlates certificates, hostnames, DNS-visible services, live TLS
configuration, certificate chains, keys, signatures, key exchange, and
symmetric ciphers.

It describes the externally observable cryptographic posture.

## Usage

```
pq-map example.com                # combined text view (default)
pq-map example.com --summary      # certificate estate summary
pq-map example.com --hosts        # hostnames of valid certificates
pq-map example.com --certs        # CT certificate records
pq-map example.com --json         # full state as JSON
pq-map example.com --graph        # semantic graph JSON (see visualization below)
pq-map example.com --refresh      # force fresh CT + full re-probe
pq-map example.com --no-probe     # CT/DNS only, no TLS handshakes
pq-map example.com --ports        # discover other services (smtp/imap/...) on hosts where 443 failed
```

Caches in `~/.cache/pq-map/`: CT 30 days, probes 24 hours. DNS resolves every run and invalidates cached probes; failed probes are cached too. `--refresh` bypasses both.

Cache files are append-only snapshots: each store writes a new timestamped file (`~/.cache/pq-map/<ct|probe|chain>/<domain>/<UTC timestamp>.json`) and reads the newest one. Snapshot files are never rewritten, removed, or pruned, so they accumulate as a per-domain history.

## Visualization

```
pq-map example.com --graph --ports > graph.json
./pq-graph.sh                 # serves ./graph.json on :8000, opens browser
./pq-graph.sh graph.json 9000
```

Interactive 3D semantic graph with node search/filtering and focused
1-hop, 2-hop, and entity-details views.

#### Examples

```
./pq-graph.sh examples/examplex.json

./pq-graph.sh examples/exampley.json
```

## ENV vars

- `CT_DB_HOST=crt.sh`
- `CT_DB_PORT=5432`
- `CT_DB_USER=guest`
- `CT_DB_DB=certwatch`
- `CT_DB_CONNECT_TIMEOUT=30`
- `CT_DB_QUERY_TIMEOUT=120`
- `CT_CACHE_TTL=604800`
- `PROBE_CACHE_TTL=86400`
- `PROBE_TIMEOUT=8`
- `PROBE_CONCURRENCY=32`
- `DNS_TIMEOUT=5`
- `DNS_ATTEMPTS=2`
- `DNS_CONCURRENCY=32`

## Build

```
cargo build --release    # rust 1.98+, libssl-dev
cargo test
```

## License

EUPL-1.2