staging-subdomain-hunt

1# Staging & Subdomain Hunt Skill
2 
3Discover staging, development, and internal subdomains through certificate transparency (crt.sh), DNS brute force, and web probing. Exploit the staging security gap — staging environments consistently have weaker security than production (no WAF, debug enabled, install pages accessible). Proven on 7 US targets where staging subdomains exposed phpinfo, WordPress install pages, and internal APIs not visible on production.
4 
5## When to Use
6 
7- Running `deep-invade` Phase 5 on a high-value target.
8- Production target is well-secured (WAF, no leaks) — pivot to staging.
9- Target has a large attack surface (e-commerce, SaaS, franchise model).
10- You need additional entry points when the main site is hardened.
11- After `subdomain-enumeration` produces a list of subdomains.
12 
13## Prerequisites
14 
15- `terminal` with curl, httpx, jq.
16- Target domain (e.g., `example.com`).
17- For DNS brute force: wordlist at `./tools/subdomains.txt`.
18 
19## How to Run
20 
21```bash
22DOMAIN="example.com"
23 
24# crt.sh discovery
25curl --max-time 30 --connect-timeout 10 -sk "https://crt.sh/?q=%25.$DOMAIN&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > subs.txt
26 
27# Probe for live hosts
28httpx -silent -l subs.txt -threads 50 -status-code -tech-detect -o alive_subs.txt
29 
30# Check for staging indicators
31grep -iE 'staging|stage|dev|test|uat|beta' alive_subs.txt
32```
33 
34## Quick Reference
35 
36| Indicator | What It Means | Action |
37|-----------|---------------|--------|
38…