hunt-subdomain

Enumerate DNS records and validate CNAMEs to identify subdomain takeover risks.

Updated May 31, 2026

Search Tags:#oauth #dns #pentest #subdomain #takeover #cname

Ready to run

npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-subdomain-grivera82

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-subdomain
Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/hunt-subdomain
Command: npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-subdomain-grivera82

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Subdomain takeover is a critical security risk where attackers can claim dormant or misconfigured subdomains and host content under trusted brands. This skill helps security teams identify, validate, and reason about takeover opportunities and potential attack chains, enabling proactive remediation and informed reporting.

Core Features & Use Cases

Enumerate DNS records and identify unclaimed CNAME targets that could be hijacked.
Analyze potential attack chains involving OAuth redirect_uri, CSP/script-src, and cookies that could impact the parent domain.
Produce structured findings with risk guidance and remediation steps for blue-team teams.

Quick Start

Run the subdomain takeover hunting workflow to enumerate subdomains, validate CNAME mappings, and identify any claimable targets.

Frequently Asked Questions about hunt-subdomain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify subdomain takeover risks by validating CNAME records?▼

Subdomain takeover risks are identified by enumerating DNS records and validating CNAME mappings to detect unclaimed resources. This involves checking if dangling CNAME targets can be claimed by attackers, enabling proactive remediation of dormant subdomains.

What is a subdomain takeover and how does it impact OAuth redirect URIs?▼

A subdomain takeover occurs when attackers claim misconfigured subdomains to host content under trusted brands. It impacts OAuth redirect URIs by allowing attackers to intercept authorization flows, potentially compromising token theft and session hijacking chains across major providers.

How do I check for dangling DNS records during a pentest engagement?▼

Checking for dangling DNS records during a pentest involves enumerating subdomains and validating CNAME ownership signals. The process uses fingerprint patterns and step-by-step checks to recognize claimable resources, collecting evidence for structured reporting and blue-team remediation.

Can subdomain takeover analysis detect CSP and CORS abuse chains?▼

Yes, subdomain takeover analysis detects CSP and CORS abuse chains by identifying claimable subdomains referenced in Content Security Policy or Cross-Origin Resource Sharing headers. This reveals potential attack vectors where hijacked subdomains bypass browser security controls.

What is needed to perform email DNS chain analysis for subdomain takeovers?▼

Email DNS chain analysis requires enumerating DNS records and validating CNAME mappings across email service providers. It identifies misconfigured MX and SPF records that could allow attackers to claim dormant subdomains for phishing or email spoofing.

When should I not rely on automated subdomain enumeration for takeover detection?▼

Automated subdomain enumeration should not be the sole method when DNS records are volatile or behind private networks. Manual validation of CNAME mappings and ownership signals is required to confirm claimable resources and avoid false positives in security posture assessments.