skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-tls-network

Identify and validate exploitable TLS/SSL and DNS misconfigurations during reconnaissance.

3|1|Updated Jul 2, 2026
Search Tags:#reconnaissance#security audit#dns#pentesting#tls#subdomain takeover
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-tls-network-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-tls-network
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-tls-network
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-tls-network-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires testssl.sh, sslyze, openssl, dig, curl, swaks.

What problem does it solve?

This skill addresses the high volume of false-positive security findings in TLS/SSL and DNS configurations by providing a rigorous, triage-focused methodology to identify only those issues that represent genuine, exploitable impact.

Core Features & Use Cases

  • Infrastructure Audit: Scans for weak ciphers, expired certificates, and DNS misconfigurations like AXFR or dangling CNAMEs.
  • Triage Validation: Provides specific validation steps to prove exploitability, such as delivering spoofed emails to an inbox or claiming a dangling subdomain.
  • Use Case: Use this during the reconnaissance phase to identify high-value infrastructure weaknesses like subdomain takeovers or mTLS bypasses that are often overlooked by automated scanners.

Quick Start

Use the hunt-tls-network skill to perform a comprehensive TLS and DNS security audit on the target domain example.com.

Frequently Asked Questions about hunt-tls-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for subdomain takeover vulnerabilities using DNS reconnaissance?▼

DNS reconnaissance for subdomain takeover involves identifying dangling CNAMEs pointing to unclaimed third-party services. This skill validates exploitability by confirming the target provider allows resource claiming, prioritizing genuine takeover threats over false positives.

How can I check if my email spoofing vulnerabilities are actually exploitable?▼

Email spoofing validation requires delivering a spoofed message to a target inbox to prove genuine impact. This skill uses swaks to simulate the attack and triage findings, confirming whether missing email security protocols truly allow spoofed delivery.

Do I need shell access and specific tools to audit TLS misconfigurations?▼

Auditing TLS misconfigurations requires shell access to execute scripts using standard network diagnostic tools. Dependencies include testssl.sh, sslyze, openssl, dig, curl, and swaks to perform rigorous validation against target infrastructure.

What is the best way to find exploitable mTLS bypasses during penetration testing?▼

Finding mTLS bypasses requires testing mutual TLS enforcement to identify weak configurations that skip client certificate validation. This skill operates during manual testing phases to validate bypasses, prioritizing high-impact findings over best-practice noise.

Why do automated TLS scanners report so many false positives and how do I triage them?▼

Automated scanners often flag best-practice deviations that lack genuine exploitable impact. This skill provides a triage-focused methodology to validate findings, filtering out noise to prioritize only those TLS and DNS misconfigurations that represent real security risks.

Related Skills

Explore More Software Engineering Skills→
MarbleSodasMarbleSodas

domain-intel

Collect subdomains, DNS records, WHOIS data, and TLS details for domains.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
dapperdiversdapperdivers
1

web-recon

Identify exposed services, technologies, directories, and TLS configurations on web applications.

Community
Advanced
ichuanichuan
1

deploy-caddy-reverse-proxy

Deploy Caddy reverse proxy with Let's Encrypt SSL and systemd integration.

Community
Advanced