What problem does it solve?
Web applications often reference external resources such as scripts, S3 buckets, GitHub Pages sites, and social handles that later expire or get decommissioned, leaving a gap attackers can claim to inject content or steal data. This Skill provides a structured workflow to find those dead references, verify they are genuinely claimable, and prove impact with a benign canary.
Core Features & Use Cases
- Dead Reference Discovery: Crawl targets with broken-link-checker, extract external scripts, CSS, and historical links from the Wayback Machine, and flag 404/000 responses.
- Takeover Verification: Match service-specific fingerprints (NoSuchBucket, GitHub Pages, Heroku, Azure, Shopify) and use subjack or nuclei takeover templates to confirm a resource is actually registrable, avoiding false positives.
- Proof-of-Concept Exploitation: Claim the expired domain, S3 bucket, or GitHub Pages repo, serve a benign canary, and assess impact such as full XSS via hijacked JavaScript.
- Use Case: During a bug bounty engagement, you find the target loads analytics JS from an expired domain; you register the domain, serve a benign marker, and report a confirmed supply-chain XSS finding.
Quick Start
Ask the AI to crawl the authorized target site for dead external links and check whether any referenced domains or cloud resources are claimable for a broken link hijacking proof of concept.
