Takeover Hunter — Development agent for Claude Code
Enumerates subdomain-takeover candidates for a previously-ingested program.
How to install Takeover Hunter
Installs to ~/.claude/agents/kennyalfredo-pr-agent-takeover-hunter.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Kennyalfredo/pr-agent/HEAD/.claude/agents/takeover-hunter.md -o ~/.claude/agents/kennyalfredo-pr-agent-takeover-hunter.md Restart Claude Code, or start a new session, for it to be picked up.
What Takeover Hunter does
name: takeover-hunter description: Enumerates subdomain-takeover candidates for a previously-ingested program. Reads memory/programs/.json, derives seed domains from in-scope wildcards, runs subfinder (passive) → dnsx (CNAME extraction) → subzy (fingerprint match against can-i-take-over-xyz database). Writes candidates (NOT verified-owned, NOT exploited) to out//takeovers/.json. Ownership verification is a separate subagent — DO NOT call it from here. Never claims the
Alternatives in Development
- Gitnexus Branch Hygiene Reviewer — GitNexus branch hygiene and mergeability reviewer 45.8k ★
- Startup Analyst — You are an expert startup business analyst specializing in helping early-stage companies (pre-seed t... inheri 31.9k ★
- Subdomain Enumeration — subfinder -d {domain} -silent sort -u subs.txt amass enum -passive -d {domain} subs.txt sort -u subs.txt -o su 213 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Recon Agent
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetf
Subfinder - Fast Passive Subdomain Enumeration Using Multiple Sources
subfinder -d target.com -all -o subdomains.txt amass enum -passive -d target.com -o amass_passive.txt assetfin
Endpoint Hunter
Hunts publicly-exposed sensitive endpoints and files for a previously-ingested program (/.env, /config., /.git
Secret Hunter
Hunts publicly-leaked credentials (API tokens, cloud keys, DB strings) that belong to a previously-ingested pr
DNS Specialist
Configura el dominio personalizado y sus registros DNS (A, CNAME, TXT), aloja app-ads.txt en raíz, verifica pr
Architecture Gap Scout
Runs find-architecture-gaps over a given scope, dedupes against previously reported initiatives, and files new
Related Skills
Hunt Takeovers
Enumerate subdomain-takeover candidates for an ingested program (passive subfinder + dnsx CNAME + subzy finger
Attack Surface
External attack-surface / recon audit of domains YOU OWN (your sites + subdomains, client sites under contract
Build Program
Build Solana programs (Anchor, Pinocchio, native), incl. verifiable builds