aegis-dns-takeover
Installation
SKILL.md
Scope & Objectives
Objective
Audit every hostname the organization claims — as evidenced by repository artifacts — and determine which of those claims can be hijacked by an attacker who registers the underlying service. For each finding produce: file:line evidence of the claimed hostname, the DNS target it resolves to, the owning artifact chain (config -> IaC -> docs), a takeover-precondition assessment per the claim table below, a status of Confirmed-static, Dangling-candidate (Needs-Review), or Verified-live, and a blast-radius statement naming exactly which cookies, OAuth clients, CSP/CORS allowlists, or phishing-trust surfaces depend on that name.
In Scope
| Class | Typical finding | Primary CWE |
|---|---|---|
| Dangling CNAME to PaaS | legacy-marketing.example.com still points at acme-legacy.herokuapp.com; app was deleted in a teardown script but the record remains |
CWE-350 |
| Dangling alias to object-storage website endpoints | Route53 A-alias to acme-old-assets.s3-website-us-east-1.amazonaws.com whose bucket no longer exists |
CWE-350 |
| Wildcard amplification | *.example.com -> one shared service; a single unclaimed name under the wildcard yields infinitely many hijackable names |
CWE-350 |
| Zone hygiene | Public zone leaks internal naming (jenkins-intranet.example.com), stale NS delegations, stale TXT ownership-proof records, missing query logging, missing CAA |
CWE-350 |
| Blast-radius artifacts in code | Cookies set with Domain=.example.com, OAuth redirect_uri lists containing inventoried subdomains, CORS/CSP allowlists trusting *.example.com |
CWE-350 |