hunt-subdomain

What problem does it solve?

This Skill helps you identify subdomains vulnerable to takeover by detecting stale DNS records that point to deprovisioned third-party resources and then validating whether the provider namespace is currently claimable.

Core Features & Use Cases

• Subdomain enumeration & resolution workflow: Collect subdomains, resolve DNS records, and prioritize candidates via CNAME chains and DNS status.
• Provider fingerprinting & detection signals: Use common takeover indicators across providers (GitHub Pages, GitLab Pages, S3, Heroku, UserVoice, Zendesk, Shopify, Fastly, and others).
• Claimability validation with guardrails: Confirm claimability by attempting to register/control the underlying resource and documenting the chain without serving malicious content.
• Impact-oriented escalation checks: Assess whether the takeover surface could enable account compromise or higher-severity outcomes (OAuth/SSO redirect abuse, shared cookies, CSP allowlists, authenticated API usage).

Quick Start

Use the hunt-subdomain skill to enumerate a target’s subdomains, resolve CNAMEs, verify provider-specific error responses, and validate claimability with reproducible evidence.