What problem does it solve? Subdomain takeover bugs are easy to miss and hard to prove: dangling CNAME records pointing to deprovisioned services (GitHub Pages, S3, Heroku, Zendesk, Vercel, Azure cloudapp) require provider-specific fingerprints and a claimability proof before a bug bounty report is accepted. This Skill provides the enumeration workflow, fingerprint catalog, and impact-escalation chains needed to turn a stale DNS record into a validated, high-severity finding. ## Core Features & Use Cases - Provider Fingerprint Detection: Match CNAME targets and HTTP error strings against known-vulnerable services including Fastly, S3, GitHub/GitLab Pages, Heroku, Shopify, UserVoice, Zendesk, Vercel, and Azure cloudapp regional pools. - Step-by-Step Hunting Methodology: Enumerate subdomains with subfinder/amass/assetfinder, resolve with dnsx, scan with subjack and nuclei takeover templates, then manually verify claimability before reporting. - Five Impact-Escalation Chains: Evaluate every takeover against OAuth redirect_uri allowlists, parent-domain cookie scope, CSP script-src allowlists, CORS regexes, and DKIM/SPF email DNS to escalate from Low to Critical severity. - Use Case: You find feedback.example.com CNAME'd to an unclaimed Zendesk host. The Skill walks you through registering the resource, proving control with a unique marker, then checking whether the subdomain sits in the OAuth redirect allowlist or shares .example.com cookies to demonstrate account-takeover impact. ## Quick Start Use the hunt-subdomain skill to check the subdomains of my authorized bug bounty target for takeover vulnerabilities and validate any dangling CNAME records you find.
