attacking-domains-end-to-end

name	attacking-domains-end-to-end
description	End-to-end domain attack methodology -- resolve, enumerate subdomains, run DNS recon, check for subdomain takeover, scan web apps, and exploit across the full domain attack surface. Orchestrates the domain-specific MCP tools.
domain	cybersecurity
subdomain	web-application-security
tags	["domain-attack","subdomain-enumeration","dns-recon","subdomain-takeover","attack-surface","web-application-security","reconnaissance","exploitation"]
version	1.0
nist_csf	["ID.RA-01","DE.CM-01","PR.DS-10"]
mitre_attack	["T1595","T1592","T1190","T1059.007","T1505.003"]

Attacking Domains End-to-End

When to Use

• When the operator targets a domain (e.g. --target example.com) instead of a bare IP
• When the assessment is an attack-surface engagement, not a single-host pentest
• When subdomain takeover is in scope (forgotten subdomains pointing at deprovisioned services)
• When DNS intelligence (zone transfers, DNSSEC, MX/NS/TXT/SPF/DMARC) would inform the attack path
• When virtual host enumeration on a web server could reveal additional applications

Prerequisites

• The operator must own or be explicitly authorized to test the target domain and ALL its subdomains
• config.yaml exploit.allowed_targets accepts domains and *.wildcard entries (e.g. *.example.com)
• dnspython (optional, pip install dnspython) for full DNS recon / zone transfers / CNAME lookups
• subfinder / amass (optional) for richer subdomain enumeration
• python-whois or whois binary (optional) for WHOIS lookups

Methodology

Phase 1: Resolve the domain

Call resolve_domain("example.com") to get the A/AAAA records. This is the bridge primitive -- every subsequent tool uses the resolved IP for IP-based tools and the domain for web tools. If the domain resolves to a CDN/WAF (Cloudflare, AWS CloudFront), note it: the IP is shared infrastructure, not the origin. Look for the origin IP via DNS history, SPF records, and MX records.

Phase 2: Enumerate subdomains

Call enumerate_subdomains("example.com", sources="crt_sh,dns_bruteforce,subfinder,amass"). This discovers the full attack surface. Each discovered subdomain is auto-authorized (added to the allowlist) so you can attack it without a per-host config edit. Pay attention to:

• Takeover candidates: subdomains that don't resolve but have a CNAME pointing at a deprovisioned service (GitHub Pages, Heroku, S3, Azure, Shopify, etc.) -- these are subdomain-takeover vulnerabilities.
• Non-standard ports: subdomains running services on unexpected ports (8080, 8443, 9090) are often less-hardened dev/staging environments.
• Forgotten environments: dev., staging., test., qa. subdomains often have weaker authentication, debug endpoints, and default creds.