skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-subdomain

Scan CNAME records and provider fingerprints to validate subdomain claimability.

5|Updated May 27, 2026
Search Tags:#bug bounty#red teaming#subdomain takeover#provider fingerprinting#DNS enumeration#CNAME resolution
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-subdomain-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-subdomain
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/hunt-subdomain
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill hunt-subdomain-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill detects and exploits subdomain vulnerabilities, enabling you to claim and use untrusted subdomains of a target domain.

Core Features & Use Cases

  • Subdomain Enumeration: Identifies subdomains of a target domain.
  • CNAME Resolution and Validation: Checks CNAME records for potential takeovers.
  • Provider Fingerprinting: Matches subdomains against known provider fingerprints.
  • Manual Verification: Provides steps for verifying subdomain claimability.
  • Attack Surface Signals: Identifies DNS and HTTP signals indicating potential subdomain takeovers.
  • Step-by-Step Hunting Methodology: Outlines a methodology for hunting subdomain vulnerabilities.
  • Impact Assessment: Evaluates the potential impact of a subdomain takeover.
  • Real Impact Examples: Provides examples of real-world subdomain takeovers.
  • Chains & Compositions: Describes advanced hunting techniques and chains for maximizing impact.
  • Related Skills & Chains: Lists related skills and chains for further context.

Quick Start

Run the hunt-subdomain skill to identify potential subdomain takeovers for the target domain 'target.com'.

Frequently Asked Questions about hunt-subdomain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find and validate subdomain takeover vulnerabilities?▼

Subdomain takeover vulnerabilities are found by scanning for dangling CNAME records, matching them against known provider fingerprints, and validating whether the untrusted subdomain can be registered and claimed.

What is provider fingerprinting in subdomain enumeration?▼

Provider fingerprinting is the process of matching resolved CNAME records against known cloud provider signatures during subdomain enumeration to identify dangling resources vulnerable to takeover.

How can subdomain takeovers be chained to increase impact in red teaming?▼

Subdomain takeovers can be chained to exploit OAuth redirect URI bypasses, cookie domain wildcards, and CORS misconfigurations, significantly increasing the attack surface impact during red teaming.

When do I need to scan CNAME records for bug bounty hunting?▼

You need to scan CNAME records for bug bounty hunting when identifying attack surface signals, specifically to detect untrusted subdomains pointing to unclaimed or expired third-party provider resources.

Can I use subdomain takeover techniques for both red team assessments and bug bounty hunting?▼

Yes, subdomain takeover techniques applying DNS enumeration, CNAME resolution, and provider fingerprinting are explicitly designed for both red team assessments and bug bounty hunting to claim untrusted resources.

What are the limitations of relying solely on DNS signals for subdomain takeover detection?▼

Relying solely on DNS signals is limiting because accurate subdomain takeover detection requires matching CNAME records against provider fingerprints and performing manual HTTP verification to confirm actual claimability.

Related Skills

AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced
thejefflarsonthejefflarson
20

oauth-implementation

Enforce strict JWT validation and redirect URI matching in OAuth/OIDC implementations.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

enum-headers-cookies

Audit HTTP response headers and cookie attributes for security misconfigurations.

Community
Advanced
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced