hunt-tls-network

Audit TLS/SSL and DNS configurations for misconfigurations and email spoofing vulnerabilities.

Updated Jul 1, 2026

Search Tags:#vulnerability assessment #DNS #security auditing #TLS/SSL #misconfiguration detection

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-tls-network-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-tls-network
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-tls-network
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-tls-network-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires testssl.sh, sslyze, openssl, curl, dig, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and report TLS/SSL and DNS misconfigurations, such as missing HSTS, weak cipher suites, expired certificates, and DNS zone transfers.

Core Features & Use Cases

TLS/SSL Audit: Perform a comprehensive audit of TLS/SSL configurations, including checking for weak ciphers, expired certificates, and protocol downgrade surfaces.
DNS Security: Detect DNS misconfigurations like AXFR, dangling CNAMEs, and email spoofing.
Use Case: Use this Skill during reconnaissance to find infrastructure weaknesses and triage them before reporting.

Quick Start

Execute the skill to audit the TLS/SSL and DNS configurations of the target domain 'example.com'.

Frequently Asked Questions about hunt-tls-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit TLS/SSL configurations for weak ciphers and expired certificates?▼

To audit TLS/SSL configurations, you can use tools like testssl.sh and sslyze to detect weak cipher suites, expired certificates, and protocol downgrade vulnerabilities. This Skill automates that comprehensive audit process for a given target domain.

What is the best way to detect DNS misconfigurations like AXFR and dangling CNAMEs?▼

Detecting DNS misconfigurations involves querying name servers to identify unauthorized zone transfers (AXFR) and dangling CNAMEs. This Skill uses dig and other utilities to automate these DNS security checks and report findings.

How does email spoofing vulnerability detection work during a security audit?▼

Email spoofing detection works by verifying DNS records like SPF, DKIM, and DMARC to see if a domain prevents unauthorized sending. This Skill includes email spoofing vulnerability checks as part of its DNS security audit.

Do I need testssl.sh and sslyze installed to check for missing HSTS?▼

Yes, you need testssl.sh and sslyze installed, along with openssl, curl, and dig. These dependencies are required for the Skill to perform comprehensive TLS/SSL auditing and verify security headers like HSTS.

Can I use this Skill for reconnaissance to find infrastructure weaknesses?▼

Yes, you can use this Skill during reconnaissance to find and triage infrastructure weaknesses before reporting. It identifies TLS/SSL and DNS misconfigurations to help prioritize vulnerabilities during security auditing.

What are the limitations of using openssl and curl for protocol downgrade detection?▼

While openssl and curl can test for protocol downgrade surfaces, relying solely on them may miss complex misconfigurations. This Skill combines them with testssl.sh and sslyze to provide a more comprehensive vulnerability assessment.