What problem does it solve? Bug bounty hunters and security researchers often miss or misreport subdomain takeover vulnerabilities because provider fingerprints change, dangling DNS records are hard to verify, and standalone takeovers get downgraded without demonstrated impact. This Skill provides a structured methodology to find, verify, and escalate subdomain takeovers into high-severity reports. ## Core Features & Use Cases - Provider Fingerprint Detection: Identify dangling CNAMEs across GitHub Pages, GitLab Pages, Fastly, Heroku, S3, Zendesk, Vercel, Azure cloudapp, Shopify, and UserVoice using DNS signals, HTTP error strings, and response headers. - Step-by-Step Verification Workflow: Enumerate subdomains with subfinder/amass/assetfinder, resolve with dnsx, scan with subjack and nuclei, then manually confirm claimability before reporting. - Impact Escalation Chains: Evaluate every takeover against five composition chains — OAuth redirect_uri theft, cookie-domain session fixation, CSP script-src bypass, CORS credentialed reads, and DKIM/SPF email spoofing — to justify High or Critical severity. - Use Case: While testing a target program, you find legacy.target.com returns a Fastly unknown-domain error. Use this Skill to confirm the origin is claimable, check whether the host appears in the app's OAuth allowlist or CSP, and write a report demonstrating a full account-takeover chain. ## Quick Start Ask the AI to check whether a list of subdomains for your bug bounty target contains any claimable subdomain takeover candidates and how to escalate their impact.
