What problem does it solve? Bug bounty hunters waste submissions on TLS/DNS findings like missing HSTS, weak ciphers, or missing CAA that triage teams routinely reject as best-practice noise. This skill separates the findings that actually pay from informational hardening notes, and defines the proof required for each. ## Core Features & Use Cases - TLS/SSL and HSTS auditing: Run testssl.sh, sslyze, and openssl checks for weak ciphers, protocol downgrade surface, certificate issues, and missing HSTS, with honest guidance on what is exploitable versus informational. - DNS and email security testing: Attempt AXFR zone transfers, evaluate SPF/DKIM/DMARC spoofability, and prove email spoofing only via delivered-to-inbox swaks tests rather than dig output alone. - High-impact finding validation: Detect dangling CNAME subdomain takeovers and mTLS bypasses via header injection, with strict validation gates requiring claimed resources, canary files, and Burp request/response evidence. - Use Case: During recon on a bug bounty target, run the certificate transparency and dangling-CNAME phases to discover a subdomain pointing at a deprovisioned S3 bucket, claim it, serve a canary file, and file a High-severity takeover report. ## Quick Start Ask the AI to audit the TLS, DNS, and email security posture of your authorized bug bounty target and triage which findings are worth reporting.
