用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill subdomain-takeover-hunt命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
基于 SOC 职业分类
正在显示 SKILL.md
| name | subdomain-takeover-hunt |
| description | Detect and verify subdomain takeover via dangling CNAME to unclaimed services. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3, subfinder, dnsx |
| tags | ["recon","subdomain","takeover","CNAME","DNS","cloud","Heroku","S3","Azure"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","port-service-discovery"] |
Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.
terminal with curl, dnsx, subfinder.subzy or subjack installed for automated detection.subdomain-enumeration.# DNS resolution with CNAME extraction
dnsx -retry 3 -a -cname -resp -silent -l alive_subs.txt | tee dns_records.txt
# Automated takeover scan
subzy run --targets alive_subs.txt --hide_fails --vuln
# Get all CNAME records
cat alive_subs.txt | dnsx -silent -cname -resp-only > cname_targets.txt
# Filter to suspicious services
grep -iE "heroku|s3\.amazonaws|azure|zendesk|shopify|github\.io|bitbucket|surge\.sh|netlify|vercel|ghost\.io|readme|statuspage|pantheon|desk\.com|campaignmonitor|intercom|unbounce|wordpress\.com|cargo\.collective" \
cname_targets.txt > takeover_candidates.txt
# subzy — fast, shows vulnerable + fingerprint
subzy run --targets alive_subs.txt --hide_fails --vuln
# subjack — with custom fingerprints
subjack -w alive_subs.txt -t 100 -timeout 30 -o takeover_results.txt \
-ssl -c ~/subjack/fingerprints.json -v
# nuclei — takeover templates
nuclei -l alive_subs.txt \
-t nuclei-templates/takeovers/ \
-o nuclei_takeover_results.txt
# For each candidate, verify the service is claimable
CANDIDATE=
dig CNAME +short
curl --max-time 30 --connect-timeout 10 -skI | -10
subfinder -d target.com -silent \
| dnsx -silent -cname \
| grep "s3.amazonaws" \
| while read line; do
sub=$(echo "$line" | awk '{print $1}' | sed 's/\.$//')
curl --max-time 30 --connect-timeout 10 -sk "https://$sub" | grep -q "NoSuchBucket" && echo "CLAIMABLE: $sub"
done
| Service | Error message or indicator | Claimable signal |
|---|---|---|
| Heroku | "No such app" / "There's nothing here" | Yes |
| S3 | "NoSuchBucket" / "The specified bucket does not exist" | Yes |
| Azure | "tenant not found" / "This tenant is not found" | Yes |
| Zendesk | "account not found" / "Help Center Closed" | Yes |
| GitHub Pages | 404 "There isn't a GitHub Pages site here" | Yes |
| Shopify | "Sorry, this shop is currently unavailable" | Yes |
| Netlify | "Not Found" / "Site not found" | Yes |
| Vercel | 404 — "DEPLOYMENT_NOT_FOUND" | Yes |
| Bitbucket | "Repository not found" | Yes |
| Surge.sh | "project not found" | Yes |
| Readme.io | "Project not found" | Yes |
| Statuspage | 404 — status page not found | Yes |
| Desk.com | "This site is currently not available" | Yes |
| Campaign Monitor | "Trying to get your email from" | Yes |
| Intercom | "This page is reserved for Intercom customers" | Yes |
| Unbounce | "The requested URL was not found" | Yes |
| WordPress.com | "Do you want to register domain.wordpress.com?" | Yes |
*.target.com → IP) produces false positives. Filter out wildcard responses before scanning for takeover.dig SUBDOMAIN CNAME +short returns a service with user-registrable namespace.curl --max-time 30 --connect-timeout 10 -sk https://SUBDOMAIN returns the service-specific error page indicating the resource is available.subdomain-enumeration — Generate the subdomain list for takeover scanning.origin-ip-discovery — If takeover is found, check if the same IP hosts other services.port-service-discovery — Scan the CNAME-resolved IP for additional exposed services.