skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-subdomain

Detect subdomain takeover vulnerabilities by analyzing DNS records and HTTP fingerprints.

3|1|Updated Jul 2, 2026
Search Tags:#security#dns#pentest#recon#subdomain#takeover
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-subdomain-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-subdomain
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-subdomain
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-subdomain-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the discovery of dangling DNS records that point to deprovisioned third-party services, preventing attackers from hijacking trusted domains to serve malicious content or bypass security controls.

Core Features & Use Cases

  • Automated Enumeration: Leverages passive and active sources to map the entire subdomain surface area of a target.
  • Vulnerability Detection: Identifies CNAMEs pointing to unclaimed cloud resources, CDNs, and SaaS providers using modern fingerprinting.
  • Impact Escalation: Guides the operator through complex attack chains including OAuth hijacking, session fixation, and CSP bypasses.

Quick Start

Use the hunt-subdomain skill to enumerate all subdomains for example.com and flag any that are vulnerable to takeover.

Frequently Asked Questions about hunt-subdomain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomain takeover vulnerabilities?▼

To find subdomain takeover vulnerabilities, analyze DNS CNAME records and validate HTTP response fingerprints against known deprovisioned third-party service patterns to confirm if the dangling cloud resources are claimable.

What is a dangling DNS record and how does it enable subdomain hijacking?▼

A dangling DNS record is a CNAME entry pointing to a deprovisioned third-party cloud or SaaS service. It enables subdomain hijacking by allowing attackers to claim the abandoned resource and serve malicious content from a trusted domain.

How do I enumerate subdomains for a target domain during a pentest?▼

To enumerate subdomains during a pentest, leverage passive and active sources to map the entire subdomain surface area of a target. This process builds a target dossier for identifying exposed external assets.

Can I use HTTP fingerprinting to detect unclaimed SaaS provider resources?▼

Yes, you can use HTTP fingerprinting to detect unclaimed SaaS provider resources by comparing HTTP response fingerprints against known patterns of deprovisioned services to verify claimability for subdomain takeover.

Do I need DNS resolution tools to verify subdomain takeover exploit chains?▼

Yes, you need DNS resolution tools and HTTP fingerprinting capabilities to verify subdomain takeover exploit chains. These tools confirm the claimability of abandoned cloud resources and validate complex attack vectors like OAuth hijacking.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

subfinder

Enumerate subdomains for a target domain using passive OSINT sources.

Community
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-ato

Analyze password reset flaws, MFA bypass, and session fixation for account takeover vulnerabilities.

Community
Advanced
pdparchitectpdparchitect
13

hunt-subdomain

Analyze DNS records and HTTP fingerprints to detect subdomain takeover vulnerabilities.

Community
Advanced
Bsh13lderBsh13lder
4

web2-recon

Enumerate subdomains, verify live hosts, collect URLs, and scan for vulnerabilities.

Community
Intermediate