Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
Install Subdomain Takeover Hunt
$ npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install uphiago/recon-skills subdomain-takeover-hunt --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/recon/subdomain-takeover-hunt .claude/skills/subdomain-takeover-hunt && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "subdomain-takeover-hunt" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt into .claude/skills/subdomain-takeover-hunt/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "subdomain-takeover-hunt", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-huntType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install uphiago/recon-skills subdomain-takeover-hunt --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/recon/subdomain-takeover-hunt .agents/skills/subdomain-takeover-hunt && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "subdomain-takeover-hunt" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt into .agents/skills/subdomain-takeover-hunt/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "subdomain-takeover-hunt", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install uphiago/recon-skills subdomain-takeover-hunt --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/recon/subdomain-takeover-hunt .cursor/skills/subdomain-takeover-hunt && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "subdomain-takeover-hunt" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt into .cursor/skills/subdomain-takeover-hunt/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "subdomain-takeover-hunt", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/uphiago/recon-skills.git --path recon/subdomain-takeover-hunt--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install uphiago/recon-skills subdomain-takeover-hunt --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/recon/subdomain-takeover-hunt .gemini/skills/subdomain-takeover-hunt && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "subdomain-takeover-hunt" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt into .gemini/skills/subdomain-takeover-hunt/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "subdomain-takeover-hunt", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install uphiago/recon-skills subdomain-takeover-huntInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/recon/subdomain-takeover-hunt .github/skills/subdomain-takeover-hunt && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "subdomain-takeover-hunt" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt into .github/skills/subdomain-takeover-hunt/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "subdomain-takeover-hunt", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install uphiago/recon-skills subdomain-takeover-hunt --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/recon/subdomain-takeover-hunt .opencode/skills/subdomain-takeover-hunt && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "subdomain-takeover-hunt" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt into .opencode/skills/subdomain-takeover-hunt/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "subdomain-takeover-hunt", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
subdomain-takeover-hunt- GitHub stars
- 1.3k
- Token cost
- ~1.5k tokens
- SKILL.md length
- 436 words
- Files
- 1
- Skills in repo
- 23
- Repo updated
- First seen
- Licence
- MIT
At a glance
Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
- Works in 5 steps: Extract CNAME Records → Automated Detection → Manual Verification → …
- Security work in your project
- SKILL.md covers When to Use, Prerequisites, Quick Detection and Procedure, plus 3 more sections
- Calls curl, shopify and netlify
What it does
Subdomain Takeover Hunt is an agent skill from uphiago/recon-skills. Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Requires curl, python3, subfinder, dnsx
It sits in Security. The repository describes itself as: Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh. The licence is MIT.
When your agent uses it
- Security work in your project
Example prompts
- “/subdomain-takeover-hunt”
Requirements
- Compatibility (from SKILL.md): Requires curl, python3, subfinder, dnsx
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 1260244. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
curlshopifynetlifyvercel
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use curl, netlify and vercel, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Requires curl, python3, subfinder, dnsx
From compatibility in the SKILL.md frontmatter.
Context cost
Subdomain Takeover Hunt loads about 1.5k tokens when it runs. Until then it costs about 26 tokens; SKILL.md has 436 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from uphiago/recon-skills at commit 1260244, republished under its MIT licence (© uphiago). 436 words, ~1,464 tokens.
Download SKILL.mdSave it as
.claude/skills/subdomain-takeover-hunt/SKILL.md (or your agent's skills folder).- name
- subdomain-takeover-hunt
- description
- Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
- compatibility
- Requires curl, python3, subfinder, dnsx
- version
- 1.1.0
- revision_date
- 2026-07-25
- license
- MIT
- platforms
- linux
- tags
- recon, subdomain, takeover, CNAME, DNS, cloud, Heroku, S3, Azure
- category
- recon
- related_skills
- subdomain-enumeration, origin-ip-discovery, port-service-discovery
Subdomain Takeover Detection
Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.
When to Use
- Subdomain enumeration produces a large list — scan for lingering DNS records.
- Target uses cloud services with shared-namespace identifiers (Heroku, S3, Azure, Zendesk, Shopify).
- A subdomain returns NXDOMAIN, 404, or "no such app" error pages.
- The CNAME target is a service with user-registrable names.
Prerequisites
terminalwith curl, dnsx, subfinder.subzyorsubjackinstalled for automated detection.- List of alive subdomains from
subdomain-enumeration.
Quick Detection
# DNS resolution with CNAME extraction
dnsx -retry 3 -a -cname -resp -silent -l alive_subs.txt | tee dns_records.txt
# Automated takeover scan
subzy run --targets alive_subs.txt --hide_fails --vulnProcedure
Phase 1 — Extract CNAME Records
# Get all CNAME records
cat alive_subs.txt | dnsx -silent -cname -resp-only > cname_targets.txt
# Filter to suspicious services
grep -iE "heroku|s3\.amazonaws|azure|zendesk|shopify|github\.io|bitbucket|surge\.sh|netlify|vercel|ghost\.io|readme|statuspage|pantheon|desk\.com|campaignmonitor|intercom|unbounce|wordpress\.com|cargo\.collective" \
cname_targets.txt > takeover_candidates.txtPhase 2 — Automated Detection
# subzy — fast, shows vulnerable + fingerprint
subzy run --targets alive_subs.txt --hide_fails --vuln
# subjack — with custom fingerprints
subjack -w alive_subs.txt -t 100 -timeout 30 -o takeover_results.txt \
-ssl -c ~/subjack/fingerprints.json -v
# nuclei — takeover templates
nuclei -l alive_subs.txt \
-t nuclei-templates/takeovers/ \
-o nuclei_takeover_results.txtPhase 3 — Manual Verification
# For each candidate, verify the service is claimable
CANDIDATE="api.target.com"
# Check what the CNAME points to
dig $CANDIDATE CNAME +short
# Check HTTP response
curl --max-time 30 --connect-timeout 10 -skI "https://$CANDIDATE" | head -10
# Key service-specific verification:
# Heroku: visit https://CANDIDATE — "no such app" = claimable
# S3: curl -s https://BUCKET_NAME.s3.amazonaws.com — 404 NoSuchBucket = claimable
# Zendesk: visit https://CANDIDATE — "account not found" = claimable
# GitHub Pages: dig CNAME returns user.github.io — 404 = claimable
# Azure: visit https://CANDIDATE — "tenant not found" = claimable
# Shopify: visit https://CANDIDATE — "Sorry, this shop is currently unavailable"Phase 4 — S3 Takeover Pipeline
subfinder -d target.com -silent \
| dnsx -silent -cname \
| grep "s3.amazonaws" \
| while read line; do
sub=$(echo "$line" | awk '{print $1}' | sed 's/\.$//')
curl --max-time 30 --connect-timeout 10 -sk "https://$sub" | grep -q "NoSuchBucket" && echo "CLAIMABLE: $sub"
donePhase 5 — Service Fingerprint Reference
| Service | Error message or indicator | Claimable signal |
|---|---|---|
| Heroku | "No such app" / "There's nothing here" | Yes |
| S3 | "NoSuchBucket" / "The specified bucket does not exist" | Yes |
| Azure | "tenant not found" / "This tenant is not found" | Yes |
| Zendesk | "account not found" / "Help Center Closed" | Yes |
| GitHub Pages | 404 "There isn't a GitHub Pages site here" | Yes |
| Shopify | "Sorry, this shop is currently unavailable" | Yes |
| Netlify | "Not Found" / "Site not found" | Yes |
| Vercel | 404 — "DEPLOYMENT_NOT_FOUND" | Yes |
| Bitbucket | "Repository not found" | Yes |
| Surge.sh | "project not found" | Yes |
| Readme.io | "Project not found" | Yes |
| Statuspage | 404 — status page not found | Yes |
| Desk.com | "This site is currently not available" | Yes |
| Campaign Monitor | "Trying to get your email from" | Yes |
| Intercom | "This page is reserved for Intercom customers" | Yes |
| Unbounce | "The requested URL was not found" | Yes |
| WordPress.com | "Do you want to register domain.wordpress.com?" | Yes |
Show full SKILL.md (162 more words)Show less
Pitfalls
- Resolving CNAME to a CDN service is not a finding. Cloudflare/CloudFront/Akamai subdomains are not claimable.
- The CNAME may point to a valid, in-use service. Always verify the error page before claiming a finding.
- Some services block automated scanners. Visit the URL in a browser to confirm.
- Subdomain takeover requires registration of the target resource. Never register resources without explicit authorization.
- Wildcard DNS (
*.target.com→ IP) produces false positives. Filter out wildcard responses before scanning for takeover.
Verification
dig SUBDOMAIN CNAME +shortreturns a service with user-registrable namespace.curl --max-time 30 --connect-timeout 10 -sk https://SUBDOMAINreturns the service-specific error page indicating the resource is available.- The CNAME target is NOT resolving to a CDN or load balancer.
- Document the exact error message and service type before reporting.
Related Skills
subdomain-enumeration— Generate the subdomain list for takeover scanning.origin-ip-discovery— If takeover is found, check if the same IP hosts other services.port-service-discovery— Scan the CNAME-resolved IP for additional exposed services.
© uphiago, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in recon/subdomain-takeover-hunt of uphiago/recon-skills.
Open the folder on GitHubat commit 1260244
Compare with similar skills
Subdomain Takeover Hunt next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Subdomain Takeover Hunt this skilluphiago/recon-skills | 1.3k | — | ~1.5k | Automated safety check: Pass | MIT | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Skill Scannergetsentry/skills | 1k | 4 repos | ~2.5k | Automated safety check: Warn | Apache-2.0 | |
| Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit | 481 | 1 repos | ~3.3k | Automated safety check: Pass | None | |
| Security Alert Triageelastic/agent-skills | 592 | 1 repos | ~3.5k | Automated safety check: Notes | Apache-2.0 | |
| Shiro Attack CLISummerSec/ShiroAttack2 | 2.6k | — | ~945 | Automated safety check: Pass | MIT |
Similar skills
- Official
- Official
Skill Scanner
getsentry/skills
Scan agent skills for security issues. An agent skill from getsentry/skills.
Serenity Aleabitoreddit
yan-labs/serenity-aleabitoreddit
Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.
- Official
Security Alert Triage
elastic/agent-skills
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
Shiro Attack CLI
SummerSec/ShiroAttack2
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…
Cve Remediation
rundeck/rundeck
Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.
More from uphiago/recon-skills
All 23 skills in this repoUnauthenticated API Endpoint Recon
uphiago/recon-skills
Flags API endpoints whose data or actions look like they should need a login but currently don't, as part of authorized security testing.
Error Log Mining
uphiago/recon-skills
Mine errorlog for creds, paths, SQL when leak hunt finds. An agent skill from uphiago/recon-skills.
JS Secrets Extraction
uphiago/recon-skills
Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
Recon Playbook
uphiago/recon-skills
A skill your agent uses when starting or restructuring an authorized external web and API assessment.
Web Enumeration
uphiago/recon-skills
Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect
401 403 Bypass Techniques
uphiago/recon-skills
A skill your agent uses when protected HTTP routes return 401 or 403.
Related
Categories
Questions about Subdomain Takeover Hunt
What does Subdomain Takeover Hunt do?
Detect and verify subdomain takeover via dangling CNAME to unclaimed services. Subdomain Takeover Hunt is an agent skill from uphiago/recon-skills. Detect and verify subdomain takeover via dangling CNAME to unclaimed services.
When should I use Subdomain Takeover Hunt?
Subdomain Takeover Hunt fits situations like: security work in your project.
How do I install Subdomain Takeover Hunt in Claude Code?
Run `npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a claude-code`. Or copy the skill folder (recon/subdomain-takeover-hunt in uphiago/recon-skills) into .claude/skills/subdomain-takeover-hunt in your project. Claude Code loads it when a task matches its description.
How do I install Subdomain Takeover Hunt in Codex?
Run `npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a codex`. Or copy the skill folder (recon/subdomain-takeover-hunt in uphiago/recon-skills) into .agents/skills/subdomain-takeover-hunt in your project. Codex loads it when a task matches its description.
Can I use Subdomain Takeover Hunt in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add uphiago/recon-skills --skill subdomain-takeover-hunt -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/subdomain-takeover-hunt, .gemini/skills/subdomain-takeover-hunt, .github/skills/subdomain-takeover-hunt and .opencode/skills/subdomain-takeover-hunt in your project.
What does Subdomain Takeover Hunt need to run?
Going by SKILL.md and its folder, Subdomain Takeover Hunt needs the command-line tools its instructions call (curl, shopify, netlify and vercel). Compatibility (from SKILL.md): Requires curl, python3, subfinder, dnsx.
Does Subdomain Takeover Hunt access the network?
SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Subdomain Takeover Hunt safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Subdomain Takeover Hunt use?
Subdomain Takeover Hunt is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Subdomain Takeover Hunt use?
About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Subdomain Takeover Hunt?
Skills that share tags, products or a category with Subdomain Takeover Hunt: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Skill Scanner (getsentry/skills, 1k stars), Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars) and Security Alert Triage (elastic/agent-skills, 592 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Subdomain Takeover Hunt?
uphiago (a GitHub user) maintains it in uphiago/recon-skills, which has 1,293 GitHub stars. The repository holds 23 skills in this directory. The repository was last updated on September 1, 2026.
Source: uphiago/recon-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.