domains / families / security / staging-subdomain-hunt

staging-subdomain-hunt

separate

Hunt staging via crt.sh when production is WAF-hardened.

When to use

• Running `deep-invade` Phase 5 on a high-value target.
• Production target is well-secured (WAF, no leaks) — pivot to staging.
• Target has a large attack surface (e-commerce, SaaS, franchise model).
• You need additional entry points when the main site is hardened.
• After `subdomain-enumeration` produces a list of subdomains.

Skill page

Source