skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

attacking-domains-end-to-end

Orchestrates domain reconnaissance, subdomain enumeration, DNS analysis, and web exploitation across an authorized attack surface.

4|Updated Apr 28, 2026
Search Tags:#penetration testing#reconnaissance#subdomain enumeration#attack surface#web scanning#subdomain takeover#dns recon
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill attacking-domains-end-to-end-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: attacking-domains-end-to-end
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/attacking-domains-end-to-end
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill attacking-domains-end-to-end-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dnspython, subfinder, amass, python-whois, and includes references (resource) components.

What problem does it solve? Assessing an entire domain rather than a single host requires coordinating many disparate steps — DNS resolution, subdomain discovery, takeover detection, WHOIS intelligence, per-host scanning, and exploitation — and doing them ad hoc leads to missed assets and unverified findings. ## Core Features & Use Cases - Full domain attack-surface methodology: A 10-phase workflow covering resolution, subdomain enumeration, DNS recon (AXFR, DNSSEC, SPF/DMARC), WHOIS, per-subdomain recon, web scanning, vhost enumeration, takeover verification, exploitation, and cross-domain chaining. - Subdomain takeover detection and verification: Identifies dangling CNAMEs pointing at deprovisioned services (GitHub Pages, Heroku, S3, Azure) and walks through claim-based confirmation. - MCP tool orchestration: Maps each phase to concrete tools such as resolve_domain, enumerate_subdomains, dns_recon, vhost_enum, run_web_scan, and run_attack_module, with guidance on when to use the domain versus the resolved IP. - Use Case: Given an authorized target like example.com, run the quick assessment workflow to enumerate subdomains via crt.sh and DNS bruteforce, detect takeover candidates, and scan each web subdomain with nikto and nuclei within minutes. ## Quick Start Ask the operator to run an end-to-end domain attack-surface assessment against an authorized target domain, starting with resolve_domain and enumerate_subdomains.

Frequently Asked Questions about attacking-domains-end-to-end

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains and detect takeover candidates?▼

Call enumerate_subdomains with sources like crt_sh, dns_bruteforce, subfinder, and amass. The output flags takeover candidates: subdomains that do not resolve but have a CNAME pointing at a deprovisioned service such as GitHub Pages, Heroku, S3, or Azure.

How do I verify a subdomain takeover vulnerability?▼

For each unresolvable subdomain with a dangling CNAME, attempt to claim the underlying resource: create a GitHub Pages repo, Heroku app, S3 bucket, or Azure web app matching the subdomain name. If your content is served, the takeover is confirmed and should be reported as critical.

What DNS reconnaissance checks should I run against a domain?▼

Use dns_recon to attempt an AXFR zone transfer, check DNSSEC status, and inspect SPF, DMARC, MX, and NS records. A successful zone transfer exposes the entire DNS zone, while missing SPF/DMARC indicates email spoofing risk.

Should I use the domain name or the resolved IP for scanning?▼

Use the domain for HTTP-based tools so Host headers, TLS SNI, and virtual hosting work correctly. Use the resolved IP for network-layer tools like nmap, Metasploit RHOSTS, hydra, and impacket, which do not rely on Host headers.

What prerequisites are required before attacking a domain?▼

You must own or have explicit written authorization for the domain and all its subdomains, and the config allowlist must accept domains and wildcard entries like *.example.com. Optional tools include dnspython for DNS recon, subfinder or amass for enumeration, and whois for registrar lookups.

When should I not use this domain-wide methodology?▼

Skip it when the engagement targets a single host or bare IP rather than a domain, or when subdomain takeover is explicitly out of scope. In those cases, per-host recon and web scanning alone are more appropriate than the full domain attack-surface workflow.

Related Skills

Explore More Software Engineering Skills→
Lento47Lento47
1

web-pentest

Runs authorized web application penetration tests with phased recon, exploitation, and reporting.

Community
Advanced
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced
GhostPWNGhostPWN
4

Reconnaissance & OSINT Automation

Map external attack surfaces by discovering subdomains, DNS records, and web technology fingerprints.

Official
Advanced
wgpsecwgpsec
1.6k

naabu-portscan

Scan hosts and CIDR ranges for open ports with JSON output.

Official
Intermediate