hunt-subdomain

Detect and analyze subdomain takeover vulnerabilities in target domains.

Updated Jul 1, 2026

Search Tags:#penetration testing #security audit #cybersecurity #subdomain takeover #DNS enumeration

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-subdomain-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-subdomain
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-subdomain
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-subdomain-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires subfinder, amass, nuclei, subjack, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill detects and analyzes subdomain takeover vulnerabilities, providing actionable information to mitigate potential security risks.

Core Features & Use Cases

Subdomain Enumeration: Identifies subdomains of a target domain that could be exploited.
Provider Fingerprinting: Detects third-party provider subdomains that may be misconfigured.
Vulnerability Analysis: Determines if a subdomain is vulnerable to takeover and the potential impact.
Use Case: An organization can use this Skill to scan its own infrastructure or client projects for subdomain takeovers that could lead to unauthorized access.

Quick Start

To scan the domain 'example.com' for subdomain takeovers, run the 'hunt-subdomain example.com'.

Frequently Asked Questions about hunt-subdomain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a domain for subdomain takeover vulnerabilities?▼

To scan a domain for subdomain takeover vulnerabilities, run the 'hunt-subdomain example.com' command. The Skill enumerates target subdomains, fingerprints third-party providers, checks for misconfigured CNAMEs and unregistered namespaces, and requires manual verification for potential impact analysis.

What is subdomain takeover and how does DNS misconfiguration cause it?▼

Subdomain takeover occurs when a DNS CNAME points to an unregistered or deprovisioned third-party service namespace. The Skill identifies these misconfigured DNS records during security audits, allowing attackers to claim the endpoint and host unauthorized content.

Do I need subfinder and amass installed to check for vulnerable CNAMEs?▼

Yes, subfinder and amass are required dependencies for the subdomain enumeration phase. Additionally, nuclei and subjack are used for provider fingerprinting and vulnerability analysis to detect misconfigured CNAMEs and unregistered namespaces effectively.

Can I automate subdomain takeover detection for cybersecurity audits?▼

Yes, you can automate subdomain takeover detection for cybersecurity audits by running the provided scripts against target domains. The Skill performs DNS resolution and provider fingerprinting automatically, though manual verification is required to confirm the vulnerability and assess impact.

What are the limitations of automated subdomain takeover detection?▼

Automated subdomain takeover detection requires manual verification to confirm vulnerabilities, as DNS resolution and provider fingerprinting may yield false positives. Limitations include dynamic DNS changes and the need to validate unregistered namespaces before reporting a definitive takeover risk.

What's the best way to find unregistered namespaces during a penetration test?▼

The best way to find unregistered namespaces during a penetration test is using subdomain enumeration combined with provider fingerprinting. This Skill leverages subfinder, amass, and subjack to detect misconfigured CNAMEs pointing to unclaimed third-party resources, yielding actionable takeover targets.