Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-10명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-conf-10 |
| description | Test for Subdomain Takeover |
| category | configuration |
| owasp_id | WSTG-CONF-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | ["CWE-16"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-10
Test for Subdomain Takeover
Subdomain takeover occurs when a subdomain's DNS record points to an external service that is no longer in use or has been deleted. Attackers can claim the abandoned resource and host their own content on the victim's subdomain. This can lead to credential theft, phishing, cookie stealing, and reputation damage. Common targets include cloud services (AWS, Azure, GitHub Pages), CDNs, and SaaS platforms.
| Service | Vulnerable Indicator |
|---|---|
| GitHub Pages | 404 - "There isn't a GitHub Pages site here" |
| Heroku | "No such app" |
| AWS S3 | "NoSuchBucket" |
| Azure | "404 Web Site not found" |
| Shopify | "Sorry, this shop is currently unavailable" |
| Tumblr | "There's nothing here" |
| Fastly | "Fastly error: unknown domain" |
| Pantheon | "404 error unknown site" |
| Zendesk | "Help Center Closed" |
| Unbounce | "The requested URL was not found" |
# Amass
amass enum -d target.com -o subdomains.txt
# Subfinder
subfinder -d target.com -o subdomains.txt
# Assetfinder
assetfinder target.com >> subdomains.txt
# Certificate Transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt
-u subdomains.txt -o subdomains.txt
#!/bin/bash
# Check DNS status for each subdomain
while read subdomain; do
result=$(dig +short "$subdomain")
if [ -z "$result" ]; then
echo "[NXDOMAIN] $subdomain"
else
echo "[RESOLVED] $subdomain -> $result"
fi
done < subdomains.txt
# Check CNAME records
while read subdomain; do
cname=$(dig +short CNAME "$subdomain")
if [ ! -z "$cname" ]; then
echo "$subdomain -> CNAME: $cname"
# Check if CNAME target resolves
target_ip=$(dig +short "$cname")
if [ -z "$target_ip" ]; then
echo " [!] POTENTIAL TAKEOVER: CNAME target doesn't resolve!"
fi
fi
done < subdomains.txt
#!/bin/bash
# Check HTTP response for takeover indicators
while read subdomain; do
response=$(curl -s -L -o /dev/null -w "%{http_code}" "https://$subdomain" 2>/dev/null)
if [ "$response" == "000" ]; then
# Connection failed - check CNAME
cname=$(dig +short CNAME "$subdomain")
if [ ! -z "$cname" ]; then
echo "[CHECK] $subdomain (CNAME: $cname) - No HTTP response"
fi
elif [ "$response" == "404" ]; then
# Get page content
content=$(curl -s -L "https://$subdomain" 2>/dev/null)
# Check for known vulnerable patterns
if echo "$content" | grep -qi "There isn't a GitHub Pages site here"; then
echo "[VULN] $subdomain - GitHub Pages takeover!"
elif echo "$content" | grep -qi "NoSuchBucket"; then
echo "[VULN] $subdomain - AWS S3 takeover!"
elif echo "$content" | grep -qi "No such app"; then
echo "[VULN] $subdomain - Heroku takeover!"
elif echo "$content" | grep -qi "this shop is currently unavailable"; then
echo "[VULN] $subdomain - Shopify takeover!"
else
echo "[CHECK] $subdomain - 404 response, manual check needed"
fi
fi
done < subdomains.txt
# Check for dangling NS records
ns_records=$(dig +short NS target.com)
for ns in $ns_records; do
# Check if NS resolves
ns_ip=$(dig +short "$ns")
if [ -z "$ns_ip" ]; then
echo "[CRITICAL] NS record doesn't resolve: $ns"
fi
# Check if NS domain is available for registration
whois "${ns%.}" | grep -i "No match\|not found"
done
# Subjack
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -ssl
# Nuclei subdomain takeover templates
nuclei -l subdomains.txt -t http/takeovers/
# Can-I-Take-Over-XYZ check
# Reference: https://github.com/EdOverflow/can-i-take-over-xyz
| Tool | Description | Usage |
|---|---|---|
| Amass | Comprehensive enum | amass enum -d target.com |
| Subfinder | Fast discovery | subfinder -d target.com |
| Assetfinder | Asset discovery | assetfinder target.com |
| Tool | Description | Usage |
|---|---|---|
| Subjack | Takeover scanner | subjack -w subs.txt -ssl |
| Nuclei | Template scanner | nuclei -t takeovers/ |
| SubOver | Takeover checker | SubOver -l subs.txt |
| tko-subs | Takeover detection | tko-subs -data providers.csv |
| Tool | Description | Usage |
|---|---|---|
| dig | DNS lookup | dig CNAME subdomain.target.com |
| dnsrecon | DNS enumeration | dnsrecon -d target.com |
| dnsx | DNS toolkit | dnsx -l subs.txt -cname |
#!/bin/bash
TARGET=$1
OUTPUT_DIR="takeover_scan_$(date +%Y%m%d)"
mkdir -p $OUTPUT_DIR
echo "=== SUBDOMAIN TAKEOVER SCAN ==="
echo "Target: $TARGET"
echo ""
# 1. Enumerate subdomains
echo "[+] Enumerating subdomains..."
subfinder -d $TARGET -silent > "$OUTPUT_DIR/subdomains_subfinder.txt"
amass enum -passive -d $TARGET -o "$OUTPUT_DIR/subdomains_amass.txt" 2>/dev/null
curl -s "https://crt.sh/?q=%.$TARGET&output=json" | jq -r '.[].name_value' 2>/dev/null | sort -u > "$OUTPUT_DIR/subdomains_crt.txt"
# Combine
cat "$OUTPUT_DIR"/subdomains_*.txt | sort -u > "$OUTPUT_DIR/all_subdomains.txt"
echo "Found $(wc -l < "$OUTPUT_DIR/all_subdomains.txt") unique subdomains"
# 2. Check DNS resolution
echo ""
echo "[+] Checking DNS resolution..."
while read sub; do
cname=$(dig +short CNAME "$sub" 2>/dev/null)
if [ ! -z "$cname" ]; then
echo "$sub,$cname" >> "$OUTPUT_DIR/cname_records.txt"
fi
done < "$OUTPUT_DIR/all_subdomains.txt"
# 3. Run subjack
echo ""
echo "[+] Running subjack..."
subjack -w "$OUTPUT_DIR/all_subdomains.txt" -t 100 -timeout 30 -o "$OUTPUT_DIR/subjack_results.txt" -ssl -a 2>/dev/null
# 4. Run nuclei takeover templates
echo ""
echo "[+] Running nuclei takeover checks..."
nuclei -l "$OUTPUT_DIR/all_subdomains.txt" -t http/takeovers/ -o "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null
# Results
echo ""
echo "[+] Scan complete. Results in $OUTPUT_DIR/"
echo "Potential takeovers:"
cat "$OUTPUT_DIR/subjack_results.txt" 2>/dev/null
cat "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null
# Install
go install github.com/haccer/subjack@latest
# Basic scan
subjack -w subdomains.txt -t 100 -timeout 30 -ssl
# With output
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -o results.txt
# Verbose
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -v
# Run all takeover templates
nuclei -l subdomains.txt -t http/takeovers/
# Specific service
nuclei -l subdomains.txt -t http/takeovers/github-takeover.yaml
nuclei -l subdomains.txt -t http/takeovers/aws-bucket-takeover.yaml
# Identify and remove unused DNS records
# In DNS management console:
# - Delete CNAME records pointing to decommissioned services
# - Delete A records pointing to released IPs
# - Update NS records if domains expired
# Set up regular scanning
# Add to cron:
0 0 * * * /path/to/takeover_scan.sh target.com
# Use OWASP Domain Protect or similar
Subdomain Takeover
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Remote exploitation |
| Attack Complexity | Low | Easy to exploit |
| Privileges Required | None | No auth needed |
| User Interaction | None | Passive attack |
| Scope | Changed | Affects other components |
| Confidentiality | High | Credential theft possible |
| CWE ID | Title | Description |
|---|---|---|
| CWE-284 | Improper Access Control | DNS record management |
| CWE-668 | Exposure of Resource to Wrong Sphere | Subdomain exposure |
[ ] Subdomain enumeration completed
[ ] DNS records analyzed (A, CNAME, NS)
[ ] CNAME targets verified
[ ] Dangling records identified
[ ] HTTP responses checked for takeover indicators
[ ] Automated tools run (subjack, nuclei)
[ ] NS records verified
[ ] Expired domains checked
[ ] Vulnerable subdomains documented
[ ] Risk assessment completed
[ ] Remediation plan provided