npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Attackers establish DNS-based persistence by hijacking DNS records, creating unauthorized subdomains, abusing wildcard DNS entries, or modifying NS delegations to redirect traffic through attacker-controlled infrastructure. These techniques survive credential rotations, endpoint reimaging, and traditional remediation because DNS changes persist independently of compromised hosts. Detection requ...
Hunts DNS persistence via hijacking, dangling CNAMEs, wildcard abuse, zone mods using SecurityTrails API, passive DNS, Python, and Route53/Azure/Cloudflare audit logs.
Hunts DNS-based persistence threats like hijacking, dangling CNAMEs, wildcard abuse, and unauthorized zone changes using SecurityTrails API, passive DNS databases, and audit logs from Route53, Azure DNS, Cloudflare. Ideal for threat hunting.
Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps infrastructure during authorized pentests to identify attack surfaces, misconfigurations, and info disclosure.
Share bugs, ideas, or general feedback.
Attackers establish DNS-based persistence by hijacking DNS records, creating unauthorized subdomains, abusing wildcard DNS entries, or modifying NS delegations to redirect traffic through attacker-controlled infrastructure. These techniques survive credential rotations, endpoint reimaging, and traditional remediation because DNS changes persist independently of compromised hosts. Detection requires passive DNS historical analysis, zone file auditing, and monitoring for unauthorized record modifications. This skill covers hunting methodologies using SecurityTrails passive DNS API, DNS audit logs from Route53/Azure DNS/Cloudflare, and zone transfer analysis.
Export current DNS zone records and establish baseline for all authorized A, AAAA, CNAME, MX, NS, and TXT records.
Use SecurityTrails API to retrieve historical DNS records and identify unauthorized changes, new subdomains, and CNAME records pointing to decommissioned services (dangling CNAMEs).
Compare current records against baseline to identify unauthorized modifications, wildcard records that resolve all subdomains, NS delegation changes, and MX record hijacking.
Correlate DNS anomalies with threat intelligence feeds, check resolution targets against known malicious infrastructure, and validate record ownership.
JSON report listing DNS anomalies with record type, historical changes, risk severity, and remediation recommendations for each finding.