hunt-subdomain

To find subdomain takeover vulnerabilities, you need to identify dangling DNS records and validate them against provider fingerprints. This skill automates collecting DNS, HTTP, and takeover signals to generate a structured report with proof of ownership for responsible disclosure.

A subdomain takeover occurs when a DNS record points to a deprovisioned external service, allowing an attacker to claim that endpoint. This skill evaluates DNS-based takeovers and related misconfigurations across major cloud providers to verify claimability and document the risk.

Validating OAuth redirect allowlists, cookie-domain scope, and CSP takeovers requires checking specific HTTP response headers and configurations. This skill performs these validation workflows across providers like Vercel, Azure, and S3 to confirm if a subdomain is claimable.

Yes, this skill works with Vercel, Azure, S3, Shopify, and Zendesk. It checks public takeover fingerprints and vendor response patterns for these major cloud providers to ensure accurate claimability validation and impact assessment.

To start auditing for vulnerable subdomain takeovers, you need access to the target organization's DNS records and public takeover fingerprints. The skill uses these inputs to enumerate takeover candidates and generate a verification-ready report with recommended mitigations.

The best way to document subdomain takeover proof of ownership is to generate a structured report detailing claimability, impact, and recommended mitigations. This skill outputs a verification-ready report that enables proactive reporting and remediation for security researchers.