What problem does it solve? A DNS name inside an in-scope wildcard does not prove the target owns the infrastructure behind it. CNAMEs pointing to SaaS vendors, ISP-hosted circuits, and honeypot cloud buckets all appear as legitimate subdomains, and testing them means attacking third parties who never authorized it. This Skill prevents scope violations that can end a bug bounty engagement or create legal exposure. ## Core Features & Use Cases - Three-question attribution check: A shell helper inspects the CNAME chain, IP ownership via whois, and reverse DNS for any newly discovered host before the first request. - Third-party detection: Recognizes CNAMEs to vendors like Webflow, Discourse, Campaign Monitor, and Google Sites, plus pages whose assets load entirely from vendor CDNs. - Cloud bucket attribution: Explains why name-permutation bucket hits are unreliable, how to spot honeypot listings, and why only buckets referenced in the target's own JS and source should be treated as in scope. - Use Case: During recon on a fintech program, vpn.target.com.mx resolves to a consumer ISP circuit. Instead of port-scanning it, you report the dangling DNS record as a hygiene finding without touching third-party equipment. ## Quick Start Ask the agent to verify whether a newly discovered subdomain is actually operated by the target before testing it.
