Hunt Subdomain | Agent Skills Atlas

About this skill

Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps cloudapp.azure.com regional-pool re-issue (1-click OAuth ATO via wildcard replyto, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel cname.vercel-dns.com deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth redirecturi, cookie-domain, email DNS).

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1

Content SHA-256: aac68521ad4a90fa5a21777f2c1c3ac05a1dfc080e066e88b0ce42571f174ca3

About scan coverage and limitations

Original listing metadata

Original name

hunt-subdomain

Original description

Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).

About this listing

Category: Security
Reported license: Not specified
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.