hunt-subdomain

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Crown Jewel Targets

Subdomain takeover is high-value because it allows an attacker to serve content from a **trusted, company-owned domain** — bypassing browser same-origin trust, phishing filters, and user skepticism simultaneously.

**Highest payout contexts:**

- Subdomains of major SaaS brands (Shopify, Snapchat, Mozilla, Yelp) where the trusted domain has user session context

- CDN-backed subdomains (Fastly, CloudFront) where CNAME points to unclaimed origins

- Third-party service integrations: UserVoice, WordPress.com, GitHub Pages, GitLab Pages, Heroku, Zendesk

- Preview/staging/dev subdomains (`new.`, `preview.`, `course.`, `delivery.`, `addons-preview.`) — abandoned after feature launches

- Subdomains used for OAuth redirect URIs or SSO endpoints — these pay highest

**Asset types that matter most:**

- CNAME records pointing to deprovisioned third-party services

- NS delegations to abandoned zones

- A records pointing to unallocated cloud IPs (less common)

- GitLab/GitHub Pages with unclaimed project namespaces

---

Attack Surface Signals

**DNS signals:**

- `CNAME` pointing to `*.github.io`, `*.gitlab.io`, `*.fastly.net`, `*.herokudns.com`, `*.wordpress.com`, `*.uservoice.com`, `*.zendesk.com`, `*.s3.amazonaws.com`, `*.azurewebsites.net`, `*.netlify.app`

- NXDOMAIN or `SERVFAIL` on the CNAME target while the parent record still exists

- NS records delegating to registrars where the zone is no longer registered

**HTTP response signals:**

- `"There isn't a GitHub Pages site here"`

- `"NoSuchBucket"` (S3)

- `"The specified bucket does not exist"`

- `"No such app"` (Heroku)

- `"Sorry, this shop is currently unavailable"` (Shopify)

- `"This UserVoice subdomain is available"`

- `"Do you want to register"` (any domain parking page)

- HTTP 404 with provider-specific error templates

- Fastly: `"Fastly error: unknown domain"`

- `"404 Web Site not found"` (Azure App Service)

**Tech stack signals:**

- Response headers: `X-Served-By: cache-*` (Fastly), `X-GitHub-Request-Id`, `Server: Netlify`

- `CNAME` chain resolving to provider infrastructure but returning provider 404

- SSL cert issued to provider wildcard (`*.fastly.net`) rather than company domain

---

Step-by-Step Hunting Methodology

1. **Enumerate all subdomains** for the target using passive + active sources:

- `subfinder -d target.com -all`

- `amass enum -passive -d target.com`

- `assetfinder --subs-only target.com`

- Certificate transparency: `crt.sh/?q=%.target.com`

2. **Resolve all subdomains** and flag those with:

- NXDOMAIN responses

- CNAME pointing to a third-party provider

```bash

cat subdomains.txt | dnsx -a -cname -o resolved.txt

```

3. **Cross-reference CNAMEs** against known vulnerable provider fingerprints using `nuclei` or `subjack`:

```bash

subjack -w subdomains.txt -t 100 -timeout 30 -ssl -c fingerprints.json

nuclei -l subdomains.txt -t takeovers/

```

4. **Manual verification** for each flagged subdomain:

- `dig CNAME subdomain.target.com` — confirm CNAME exists

- `dig A <cname-target>` — confirm NXDOMAIN or no resolution

- `curl -sk https://subdomain