hunt-subdomain

Subdomain takeover occurs when stale DNS CNAME records point to deprovisioned third-party resources. The skill maps these CNAME chains to provider infrastructure and checks for provider-specific not found signals to identify vulnerable subdomains.

To validate claimability during bug bounty triage, the skill attempts to register the underlying resource and documents the CNAME chain without serving malicious content, applying a claimability validation gate before reporting.

Yes, subdomain takeover detection uses common takeover indicators across providers like GitHub Pages, Heroku, S3, GitLab Pages, Fastly, Shopify, and Zendesk to identify unclaimed or not found responses.

Assess subdomain takeover impact by checking if the takeover surface enables account compromise via OAuth/SSO redirect abuse, shared cookies, CSP allowlists, or authenticated API usage.

The best way to automate takeover hunting is to collect subdomains through passive enumeration or certificate transparency, resolve DNS records, and prioritize candidates via CNAME chains and DNS status for fingerprint matching.

You should not validate subdomain takeover without guardrails when the provider namespace is claimable, as the skill enforces documentation of the chain without serving malicious content to prevent abuse.