hunt-subdomain

Subdomain takeover detection involves enumerating subdomains with tools like subfinder and amass, then checking DNS CNAME records and HTTP responses for unclaimed endpoints. This skill automates that scanning process and verifies subdomain claimability for red teaming scenarios.

Subdomain takeover occurs when an unclaimed subdomain points to a deprovisioned external service, allowing attackers to serve malicious content under a trusted domain. You need to scan for it during web application security auditing to prevent attackers from claiming dangling DNS records.

Yes, subdomain vulnerability scanning integrates subfinder, amass, and assetfinder for enumeration, nuclei for vulnerability detection, and subjack for takeover verification. This skill orchestrates these dependencies to identify claimable subdomains across various providers.

Verifying subdomain claimability requires checking provider-specific error messages in HTTP responses and DNS records, then attempting to register the unclaimed subdomain. This skill handles common subdomain providers to confirm control and assess potential impact.

Yes, checking for unclaimed subdomains requires subfinder, amass, assetfinder, nuclei, and subjack installed. These dependencies provide the enumeration depth and provider-specific detection logic needed to identify and verify subdomain vulnerabilities.

Subdomain enumeration may miss vulnerable CNAME records if passive sources are limited or DNS entries are properly managed. This skill combines multiple enumeration tools and active verification to reduce false negatives when identifying dangling subdomain pointers.