Staging & Subdomain Hunt Skill

Discover staging, development, and internal subdomains through certificate transparency (crt.sh), DNS brute force, and web probing. Exploit the staging security gap — staging environments consistently have weaker security than production (no WAF, debug enabled, install pages accessible). Proven on 7 US targets where staging subdomains exposed phpinfo, WordPress install pages, and internal APIs not visible on production.

When to Use

• Running deep-invade Phase 5 on a high-value target.
• Production target is well-secured (WAF, no leaks) — pivot to staging.
• Target has a large attack surface (e-commerce, SaaS, franchise model).
• You need additional entry points when the main site is hardened.
• After subdomain-enumeration produces a list of subdomains.

Prerequisites

• terminal with curl, httpx, jq.
• Target domain (e.g., example.com).
• For DNS brute force: wordlist at ./tools/subdomains.txt.

How to Run