hunt-subdomain
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Verification boundaries
Provider fingerprints, historical cases and payout claims below are hypotheses unless supported by current primary documentation and engagement evidence. DNS errors or 404s do not prove claimability; ownership verification may prevent claims. A subdomain is a different origin from siblings even with parent-Domain cookies. HttpOnly cookies are not JavaScript-readable. A CSP allowlist alone does not cause script loading; OAuth codes may remain protected by PKCE, client authentication and redirect binding. Assess prerequisites rather than promising ATO. Use designated test identities and harmless markers, never real users’ sessions, emails or credentials. Resource registration, spend and persistence need explicit authorization and agreed cleanup; do not claim resources merely to check availability.
Subdomain takeover is high-value because it allows an attacker to serve content from a trusted, company-owned domain — creating a trusted-host content risk whose impact depends on application and browser boundaries.