hunt-tls-network

Name: hunt-tls-network
Availability: InStock
Author: entrovyx

Identify and validate exploitable TLS/SSL and DNS misconfigurations during reconnaissance.

3|1|Updated Jul 2, 2026

Search Tags:#reconnaissance #security audit #dns #pentesting #tls #subdomain takeover

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-tls-network-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-tls-network
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-tls-network
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-tls-network-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires testssl.sh, sslyze, openssl, dig, curl, swaks.

What problem does it solve?

This skill addresses the high volume of false-positive security findings in TLS/SSL and DNS configurations by providing a rigorous, triage-focused methodology to identify only those issues that represent genuine, exploitable impact.

Core Features & Use Cases

Infrastructure Audit: Scans for weak ciphers, expired certificates, and DNS misconfigurations like AXFR or dangling CNAMEs.
Triage Validation: Provides specific validation steps to prove exploitability, such as delivering spoofed emails to an inbox or claiming a dangling subdomain.
Use Case: Use this during the reconnaissance phase to identify high-value infrastructure weaknesses like subdomain takeovers or mTLS bypasses that are often overlooked by automated scanners.

Quick Start

Use the hunt-tls-network skill to perform a comprehensive TLS and DNS security audit on the target domain example.com.

Frequently Asked Questions about hunt-tls-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for subdomain takeover vulnerabilities using DNS reconnaissance?▼

DNS reconnaissance for subdomain takeover involves identifying dangling CNAMEs pointing to unclaimed third-party services. This skill validates exploitability by confirming the target provider allows resource claiming, prioritizing genuine takeover threats over false positives.

How can I check if my email spoofing vulnerabilities are actually exploitable?▼

Email spoofing validation requires delivering a spoofed message to a target inbox to prove genuine impact. This skill uses swaks to simulate the attack and triage findings, confirming whether missing email security protocols truly allow spoofed delivery.

Do I need shell access and specific tools to audit TLS misconfigurations?▼

Auditing TLS misconfigurations requires shell access to execute scripts using standard network diagnostic tools. Dependencies include testssl.sh, sslyze, openssl, dig, curl, and swaks to perform rigorous validation against target infrastructure.

What is the best way to find exploitable mTLS bypasses during penetration testing?▼

Finding mTLS bypasses requires testing mutual TLS enforcement to identify weak configurations that skip client certificate validation. This skill operates during manual testing phases to validate bypasses, prioritizing high-impact findings over best-practice noise.

Why do automated TLS scanners report so many false positives and how do I triage them?▼

Automated scanners often flag best-practice deviations that lack genuine exploitable impact. This skill provides a triage-focused methodology to validate findings, filtering out noise to prioritize only those TLS and DNS misconfigurations that represent real security risks.