domains / families / security / hunt-subdomain

hunt-subdomain

authentic

Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).

When to use

• subdomain takeover hunting
• ATO-chain primitives
• OAuth redirect_uri exploitation
• cookie-domain exploitation
• email DNS exploitation
• provider fingerprint matching
• CNAME dangling detection
• S3 dangling-bucket techniques

Skill page

Source