subdomain-takeover

Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and impact multipliers. Converted from master-pentest-prompt.md Phase 17. Use on every subdomain found during recon, every engagement.

Ir a la instalación

Repositorio: ankitsingh015/HuntMCP
Última actividad en el origen: 24 de agosto de 2026 a las 11:48
Idioma detectado de SKILL.md: inglés
Estrellas: 4
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/ankitsingh015/HuntMCP --skill subdomain-takeover

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

access-control-and-idor

Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md Phases 8/8.5. Use on any endpoint that returns or modifies user-specific data, and any multi-role application.

2026-08-26

csrf-cors-origin

CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

2026-08-26

injection-and-rce

Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus concrete exploitation mechanics for SSTI-per-engine, unauthenticated Redis RCE, filename argument injection, and cloud-metadata-to-RCE chaining. Converted from master-pentest-prompt.md Phases 2/3. Use during scan-agent's injection-testing pass on any target with user-controlled input reaching a backend.

2026-08-26

Ver todos los de este repositorio

Subdomain takeover -- full matrix

When to use

Every engagement, on every enumerated subdomain -- this is cheap to check and frequently rewarded, so it should never be skipped even when it doesn't feel like the main focus.

Procedure

Enumerate all subdomains (subfinder-mcp, crt.sh), then dig +short CNAME each one.

Flag CNAMEs pointing at a takeover-prone provider: GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, Zendesk, Fastly, Vercel, ReadMe, Pantheon, GitLab Pages, Ghost, Tumblr, Surge, Azure Traffic Manager.

Fingerprint claimable-string signatures in the response: "There isn't a GitHub Pages site here", "NoSuchBucket", "No such app", "404 Web Site not found", "This shop is currently unavailable" -- and check against a can-i-take-over-xyz-style fingerprint database for anything not covered above.

The four takeover mechanisms

CNAME -> NXDOMAIN (the cleanest signal -- the CNAME target doesn't resolve at all).

CNAME -> expired apex domain.

A record -> recycled cloud IP (the IP was reassigned to another cloud customer).

NS delegation -> abandoned zone (full DNS control if claimable -- this is the highest-impact variant).

MX -> dead host.

Impact multipliers

A takeover is worth more when the subdomain also carries: cookies scoped to Domain=<parent> (session-cookie theft from the parent domain), a CSP script-src allowlist entry (bypasses CSP on the main app), an OAuth redirect_uri allowlist entry (token theft via the OAuth flow -- see the open-redirect skill), a SAML entityID, or an SPF/DKIM include: reference (email spoofing capability, see the email-security skill). Note any of these explicitly in the writeup -- they're what turns a takeover from informational into critical.

Subdomain takeover -- full matrix

When to use

Every engagement, on every enumerated subdomain -- this is cheap to check and frequently rewarded, so it should never be skipped even when it doesn't feel like the main focus.

Procedure

Enumerate all subdomains (subfinder-mcp, crt.sh), then dig +short CNAME each one.

The four takeover mechanisms

CNAME -> NXDOMAIN (the cleanest signal -- the CNAME target doesn't resolve at all).

CNAME -> expired apex domain.

A record -> recycled cloud IP (the IP was reassigned to another cloud customer).

NS delegation -> abandoned zone (full DNS control if claimable -- this is the highest-impact variant).

MX -> dead host.

Impact multipliers

name	subdomain-takeover
description	Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and impact multipliers. Converted from master-pentest-prompt.md Phase 17. Use on every subdomain found during recon, every engagement.

subdomain-takeover

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio