What problem does it solve? Subdomain takeover bugs are easy to miss and hard to prove: dangling CNAME records pointing to deprovisioned services (GitHub Pages, S3, Heroku, Zendesk, Vercel, Fastly) sit unnoticed in DNS, and even when found, hunters struggle to demonstrate real impact beyond a defacement-level Low. This Skill provides a complete methodology to enumerate, fingerprint, claim, and escalate subdomain takeovers into high-severity account-takeover chains. ## Core Features & Use Cases - Provider Fingerprint Library: Detection signatures for GitHub/GitLab Pages, S3, Heroku, Zendesk, UserVoice, Shopify, Fastly, Vercel, Azure cloudapp, and Netlify, including HTTP error strings, DNS signals, and response headers. - Step-by-Step Hunting Workflow: Enumeration with subfinder/amass/assetfinder, CNAME resolution with dnsx, automated scanning with subjack and nuclei, and manual claim verification per provider. - Five Escalation Chains: Maps every takeover to OAuth redirect_uri theft, cookie-domain session fixation, CSP script-src bypass, CORS credentialed reads, or DKIM/SPF email spoofing to justify High/Critical severity. - Use Case: You find assets.target.com returning "Fastly error: unknown domain". Follow the workflow to confirm the CNAME is unclaimed, attach the domain to a new Fastly service, publish a unique marker page, then check whether the parent app's CSP allowlists the host to escalate the report from Informational to Critical. ## Quick Start Enumerate subdomains for my target, check each CNAME against the takeover fingerprints, and tell me which ones are claimable and how to prove impact.
