Agent skill
hunting-subdomain-takeover
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/hunting-subdomain-takeover
SKILL.md
name: hunting-subdomain-takeover description: >- Hunt for subdomain takeover vulnerabilities by identifying dangling DNS records pointing to deprovisioned cloud services, abandoned CNAME targets, and unclaimed resources. domain: cybersecurity subdomain: bug-bounty tags:
- subdomain-takeover
- dns
- dangling-cname
- cloud version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1584.001"] frameworks: ["MITRE ATT&CK"] tools: ["subfinder", "subjack", "nuclei"]
Hunting Subdomain Takeover
Overview
Hunt for subdomain takeover vulnerabilities by identifying dangling DNS records pointing to deprovisioned cloud services, abandoned CNAME targets, and unclaimed resources.
Prerequisites
| Tool / Requirement | Details |
|---|---|
subfinder |
Security tooling |
subjack |
Security tooling |
nuclei |
Security tooling |
| subfinder, subjack/can-i-take-over-xyz, nuclei templates, DNS access | Environment requirement |
Quick Reference
# Quick start commands
node scripts/agent.js --help
subfinder -d target.com -o subdomains.txt
Workflow
Step 1: Enumerate Subdomains
subfinder -d target.com -o subdomains.txt
Step 2: Check Takeover Candidates
node scripts/agent.js scan --domain target.com --subdomains subdomains.txt
Step 3: Verify Takeover
node scripts/agent.js verify --subdomain vuln.target.com --service s3
Verification
- Verify scan:
node scripts/agent.js scan --domain target.com --subdomains subdomains.txt - Confirm takeover:
node scripts/agent.js verify --subdomain vuln.target.com --service s3
References
- MITRE ATT&CK: T1584.001
- Frameworks: MITRE ATT&CK
- Tools: subfinder, subjack, nuclei
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?