staging-subdomain-hunt

What problem does it solve?

Production web assets are often secured with WAFs and strict access controls, leaving staging, development, and internal subdomains as low-security, overlooked entry points for penetration testers that are frequently missed during standard reconnaissance.

Core Features & Use Cases

• Certificate Transparency Enumeration: Uses crt.sh to discover hidden staging, internal, and franchise subdomains not visible in public DNS records.
• Live Host Probing: Identifies active subdomains and prioritizes staging, development, and API endpoints for further testing.
• Staging Security Gap Analysis: Compares staging configuration against production to identify missing WAFs, exposed debug tools, unconfigured WordPress installs, and weak CORS policies.
• Proven Field Validation: Tested on 7 US targets to uncover 20+ internal subdomains, unpatched WordPress install pages, and exposed .env/phpinfo files on staging environments. For example, a pentester targeting a hardened e-commerce production site can use this skill to find an unconfigured WordPress staging subdomain that allows full site takeover, bypassing all production security controls.

Quick Start

Use the staging-subdomain-hunt skill to enumerate all staging and internal subdomains for the target domain example.com, probe for live hosts, and identify unpatched WordPress install pages and exposed sensitive files on staging environments.