Hunt Subdomain
Hunting skill for subdomain takeover vulnerabilities.
Install
npx skills add Zyrexnn/Cybermes --skill hunt-subdomain -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints, Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover, emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).
Crown Jewel Targets
Subdomain takeover is high-value because it allows an attacker to serve content from a trusted, company-owned domain, bypassing browser same-origin trust, phishing filters, and user skepticism simultaneously.
Highest payout contexts:
- Subdomains of major SaaS brands (Shopify, Snapchat, Mozilla, Yelp) where the trusted domain has user session context
- CDN-backed subdomains (Fastly, CloudFront) where CNAME points to unclaimed origins
- Third-party service integrations: UserVoice, WordPress.com, GitHub Pages, GitLab Pages, Heroku, Zendesk
- Preview/staging/dev subdomains (
new.,preview.,course.,delivery.,addons-preview.), abandoned after feature launches - Subdomains used for OAuth redirect URIs or SSO endpoints, these pay highest
Asset types that matter most:
- CNAME records pointing to deprovisioned third-party services
- NS delegations to abandoned zones
- A records pointing to unallocated cloud IPs (less common)
- GitLab/GitHub Pages with unclaimed project namespaces
Attack Surface Signals
DNS signals:
CNAMEpointing to*.github.io,*.gitlab.io,*.fastly.net,*.herokudns.com,*.wordpress.com,*.uservoice.com,*.zendesk.com,*.s3.amazonaws.com,*.azurewebsites.net,*.netlify.app- NXDOMAIN or
SERVFAILon the CNAME target while the parent record still exists - NS records delegating to registrars where the zone is no longer registered
HTTP response signals:
"There isn't a GitHub Pages site here""NoSuchBucket"(S3)"The specified bucket does not exist""No such app"(Heroku)"Sorry, this shop is currently unavailable"(Shopify)"This UserVoice subdomain is available""Do you want to register"(any domain parking page)- HTTP 404 with provider-specific error templates
- Fastly:
"Fastly error: unknown domain" "404 Web Site not found"(Azure App Service)
