用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-10命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
正在显示 SKILL.md
基于 SOC 职业分类
| name | wstg-conf-10 |
| description | Test for Subdomain Takeover |
| category | configuration |
| owasp_id | WSTG-CONF-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | ["CWE-16"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-10
Test for Subdomain Takeover
Subdomain takeover occurs when a subdomain's DNS record points to an external service that is no longer in use or has been deleted. Attackers can claim the abandoned resource and host their own content on the victim's subdomain. This can lead to credential theft, phishing, cookie stealing, and reputation damage. Common targets include cloud services (AWS, Azure, GitHub Pages), CDNs, and SaaS platforms.
| Service | Vulnerable Indicator |
|---|---|
| GitHub Pages | 404 - "There isn't a GitHub Pages site here" |
| Heroku | "No such app" |
| AWS S3 | "NoSuchBucket" |
| Azure | "404 Web Site not found" |
| Shopify | "Sorry, this shop is currently unavailable" |
| Tumblr | "There's nothing here" |
| Fastly | "Fastly error: unknown domain" |
| Pantheon | "404 error unknown site" |
| Zendesk | "Help Center Closed" |
| Unbounce | "The requested URL was not found" |
# Amass
amass enum -d target.com -o subdomains.txt
# Subfinder
subfinder -d target.com -o subdomains.txt
# Assetfinder
assetfinder target.com >> subdomains.txt
# Certificate Transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt
-u subdomains.txt -o subdomains.txt
#!/bin/bash
# Check DNS status for each subdomain
while read subdomain; do
result=$(dig +short "$subdomain")
if [ -z "$result" ]; then
echo "[NXDOMAIN] $subdomain"
else
echo "[RESOLVED] $subdomain -> $result"
fi
done < subdomains.txt
# Check CNAME records
while read subdomain; do
cname=$(dig +short CNAME "$subdomain")
if [ ! -z "$cname" ]; then
echo "$subdomain -> CNAME: $cname"
# Check if CNAME target resolves
target_ip=$(dig +short "$cname")
if [ -z "$target_ip" ]; then
echo " [!] POTENTIAL TAKEOVER: CNAME target doesn't resolve!"
fi
fi
done < subdomains.txt
#!/bin/bash
# Check HTTP response for takeover indicators
while read subdomain; do
response=$(curl -s -L -o /dev/null -w "%{http_code}" "https://$subdomain" 2>/dev/null)
if [ "$response" == "000" ]; then
# Connection failed - check CNAME
cname=$(dig +short CNAME "$subdomain")
if [ ! -z "$cname" ]; then
echo "[CHECK] $subdomain (CNAME: $cname) - No HTTP response"
fi
elif [ "$response" == "404" ]; then
# Get page content
content=$(curl -s -L "https://$subdomain" 2>/dev/null)
# Check for known vulnerable patterns
if echo "$content" | grep -qi "There isn't a GitHub Pages site here"; then
echo "[VULN] $subdomain - GitHub Pages takeover!"
elif echo "$content" | grep -qi "NoSuchBucket"; then
echo "[VULN] $subdomain - AWS S3 takeover!"
elif echo "$content" | grep -qi "No such app"; then
echo "[VULN] $subdomain - Heroku takeover!"
elif echo "$content" | grep -qi "this shop is currently unavailable"; then
echo "[VULN] $subdomain - Shopify takeover!"
else
echo "[CHECK] $subdomain - 404 response, manual check needed"
fi
fi
done < subdomains.txt
# Check for dangling NS records
ns_records=$(dig +short NS target.com)
for ns in $ns_records; do
# Check if NS resolves
ns_ip=$(dig +short "$ns")
if [ -z "$ns_ip" ]; then
echo "[CRITICAL] NS record doesn't resolve: $ns"
fi
# Check if NS domain is available for registration
whois "${ns%.}" | grep -i "No match\|not found"
done
# Subjack
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -ssl
# Nuclei subdomain takeover templates
nuclei -l subdomains.txt -t http/takeovers/
# Can-I-Take-Over-XYZ check
# Reference: https://github.com/EdOverflow/can-i-take-over-xyz
| Tool | Description | Usage |
|---|---|---|
| Amass | Comprehensive enum | amass enum -d target.com |
| Subfinder | Fast discovery | subfinder -d target.com |
| Assetfinder | Asset discovery | assetfinder target.com |
| Tool | Description | Usage |
|---|---|---|
| Subjack | Takeover scanner | subjack -w subs.txt -ssl |
| Nuclei | Template scanner | nuclei -t takeovers/ |
| SubOver | Takeover checker | SubOver -l subs.txt |
| tko-subs | Takeover detection | tko-subs -data providers.csv |
| Tool | Description | Usage |
|---|---|---|
| dig | DNS lookup | dig CNAME subdomain.target.com |
| dnsrecon | DNS enumeration | dnsrecon -d target.com |
| dnsx | DNS toolkit | dnsx -l subs.txt -cname |
#!/bin/bash
TARGET=$1
OUTPUT_DIR="takeover_scan_$(date +%Y%m%d)"
mkdir -p $OUTPUT_DIR
echo "=== SUBDOMAIN TAKEOVER SCAN ==="
echo "Target: $TARGET"
echo ""
# 1. Enumerate subdomains
echo "[+] Enumerating subdomains..."
subfinder -d $TARGET -silent > "$OUTPUT_DIR/subdomains_subfinder.txt"
amass enum -passive -d $TARGET -o "$OUTPUT_DIR/subdomains_amass.txt" 2>/dev/null
curl -s "https://crt.sh/?q=%.$TARGET&output=json" | jq -r '.[].name_value' 2>/dev/null | sort -u > "$OUTPUT_DIR/subdomains_crt.txt"
# Combine
cat "$OUTPUT_DIR"/subdomains_*.txt | sort -u > "$OUTPUT_DIR/all_subdomains.txt"
echo "Found $(wc -l < "$OUTPUT_DIR/all_subdomains.txt") unique subdomains"
# 2. Check DNS resolution
echo ""
echo "[+] Checking DNS resolution..."
while read sub; do
cname=$(dig +short CNAME "$sub" 2>/dev/null)
if [ ! -z "$cname" ]; then
echo "$sub,$cname" >> "$OUTPUT_DIR/cname_records.txt"
fi
done < "$OUTPUT_DIR/all_subdomains.txt"
# 3. Run subjack
echo ""
echo "[+] Running subjack..."
subjack -w "$OUTPUT_DIR/all_subdomains.txt" -t 100 -timeout 30 -o "$OUTPUT_DIR/subjack_results.txt" -ssl -a 2>/dev/null
# 4. Run nuclei takeover templates
echo ""
echo "[+] Running nuclei takeover checks..."
nuclei -l "$OUTPUT_DIR/all_subdomains.txt" -t http/takeovers/ -o "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null
# Results
echo ""
echo "[+] Scan complete. Results in $OUTPUT_DIR/"
echo "Potential takeovers:"
cat "$OUTPUT_DIR/subjack_results.txt" 2>/dev/null
cat "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null
# Install
go install github.com/haccer/subjack@latest
# Basic scan
subjack -w subdomains.txt -t 100 -timeout 30 -ssl
# With output
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -o results.txt
# Verbose
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -v
# Run all takeover templates
nuclei -l subdomains.txt -t http/takeovers/
# Specific service
nuclei -l subdomains.txt -t http/takeovers/github-takeover.yaml
nuclei -l subdomains.txt -t http/takeovers/aws-bucket-takeover.yaml
# Identify and remove unused DNS records
# In DNS management console:
# - Delete CNAME records pointing to decommissioned services
# - Delete A records pointing to released IPs
# - Update NS records if domains expired
# Set up regular scanning
# Add to cron:
0 0 * * * /path/to/takeover_scan.sh target.com
# Use OWASP Domain Protect or similar
Subdomain Takeover
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Remote exploitation |
| Attack Complexity | Low | Easy to exploit |
| Privileges Required | None | No auth needed |
| User Interaction | None | Passive attack |
| Scope | Changed | Affects other components |
| Confidentiality | High | Credential theft possible |
| CWE ID | Title | Description |
|---|---|---|
| CWE-284 | Improper Access Control | DNS record management |
| CWE-668 | Exposure of Resource to Wrong Sphere | Subdomain exposure |
[ ] Subdomain enumeration completed
[ ] DNS records analyzed (A, CNAME, NS)
[ ] CNAME targets verified
[ ] Dangling records identified
[ ] HTTP responses checked for takeover indicators
[ ] Automated tools run (subjack, nuclei)
[ ] NS records verified
[ ] Expired domains checked
[ ] Vulnerable subdomains documented
[ ] Risk assessment completed
[ ] Remediation plan provided