EdgeIQ Subdomain Hunter

Performs passive subdomain enumeration using CT logs, DNS zone transfer checks, takeover detection, and optional bruteforce without active probing.

Security Scan

The skill claims to be passive and declares no required credentials, but the shipped code performs active DNS/resolution/AXFR attempts and relies on undocumented environment variables and a local license file — the behavior and requirements don't fully match the description.

Purpose & Capability

The description promises 'passive' enumeration (CT logs, no active probing) but the code performs active DNS resolution, bruteforce queries, and attempts zone transfer/AXFR-like TCP interactions — these are active probes. The skill also includes a licensing/payment model even though registry metadata lists no required credentials or config. This mismatch between advertised 'passive' behavior and implemented active network probing is a substantive inconsistency.

Instruction Scope

SKILL.md and README instruct the user to set EDGEIQ_EMAIL or a license file to unlock Pro/Bundle and to run the Python script; the runtime code contacts crt.sh and performs DNS/hostname resolution and takeover checks. The docs repeatedly claim 'no active probing' while instructing bruteforce and AXFR checks. The instructions also propose using the skill from Discord, and include external links (Stripe, Discord) — those endpoints are expected for a paid tool, but the omission of EDGEIQ_* env vars from declared requirements is a scope mismatch.

Install Mechanism

There is no install spec (instruction-only), and no external binary downloads — the distribution is just Python files. This is lower risk than arbitrary remote downloads, but the package does include executable code that will run network operations. Also the SKILL.md implies copying files into ~/.openclaw/skills; the presence of code files contradicts the 'instruction-only' framing in metadata (minor inconsistency).

Credentials

Registry metadata declares no required env vars or credentials, yet SKILL.md and the code read EDGEIQ_EMAIL and EDGEIQ_LICENSE_KEY and a local license file (~/.edgeiq/license.key). The licensing module also treats a specific email ([e-mail]) as sufficient to grant Pro/Bundle access — this is an undocumented local bypass and an odd, unjustified use of an env var. Requesting or using these env vars should have been declared and justified in metadata.

Persistence & Privilege

The skill does not request always: true and does not appear to modify other skills or system-wide agent settings. It reads a local license file and environment variables but does not request elevated privileges or persistent, autonomous installation. No evidence of persistent background processes or self-enablement beyond being installed as a skill.

What to consider before installing

This skill is inconsistent in important ways: it advertises passive reconnaissance but the code actively resolves hostnames, runs bruteforce resolution, and attempts zone-transfer-like network activity. Metadata says no env vars are required, yet the tool uses EDGEIQ_EMAIL, EDGEIQ_LICENSE_KEY, and ~/.edgeiq/license.key to unlock paid features — the author even hardcodes a specific email that will enable Pro features locally. Before installing or running: (1) review the Python source yourself or in an isolated VM/container to see exactly what network calls it makes; (2) do not set EDGEIQ_EMAIL to someone else's email (it will falsely grant Pro access locally); (3) be aware bruteforce and AXFR checks are active network actions and may be considered intrusive or illegal against domains you don't own — follow the legal notice; (4) ask the publisher for a homepage/source repo and clarification why EDGEIQ_EMAIL and license files are not declared in metadata. If you need passive-only CT scraping, consider using a tool that documents only CT queries and does not perform DNS bruteforce or AXFR attempts.

Subdomain Hunter

Skill Name: subdomain-hunter
Version: 1.0.0
Category: Security / Reconnaissance
Price: Free (basic) / Pro ($19/mo) / Bundle ($39/mo)
Author: EdgeIQ Labs
OpenClaw Compatible: Yes — Python 3, pure stdlib + socket, WSL + Linux

---

What It Does

Passive subdomain enumeration using Certificate Transparency logs, DNS zone transfer checks, and takeover detection. Reconnaissance-grade discovery without sending active probes.

⚠️ Legal Notice: Only enumerate domains you own or have explicit written permission to audit. Unauthorized recon is illegal.

---

Features

• Certificate Transparency enumeration — scrape crt.sh for subdomain history
• DNS zone transfer check — attempt AXFR with common NS records
• Takeover detection — identify subdomains pointing to unclaimed/inactive services (CNAME to dead endpoints)
• Common subdomain bruteforce — lightweight wordlist scan for common subdomains
• Subdomain resolution — verify discovered subdomains resolve
• JSON export — structured output for integration

---

Tier Comparison

Feature	Free	Pro ($19/mo)	Bundle ($39/mo)
CT log enumeration	✅ (50 results)	✅ (unlimited)	✅ (unlimited)
Zone transfer check	✅	✅	✅
Takeover detection	—	✅	✅
Bruteforce wordlist	—	✅ (500 names)	✅ (2000 names)
JSON export	—	✅	✅
Concurrent resolution	—	✅ (20 threads)	✅ (50 threads)

---

Installation

cp -r /home/guy/.openclaw/workspace/apps/subdomain-hunter ~/.openclaw/skills/subdomain-hunter

---

Usage

Basic scan (free tier — 50 results)

python3 subdomain_hunter.py --domain example.com

Pro scan (unlimited + takeover detection)

EDGEIQ_EMAIL=[e-mail] python3 subdomain_hunter.py --domain example.com --pro

Full bundle scan (bruteforce + concurrent threads)

EDGEIQ_EMAIL=[e-mail] python3 subdomain_hunter.py --domain example.com --bundle --bruteforce

Export to JSON

python3 subdomain_hunter.py --domain example.com --output results.json

Check for takeovers only

python3 subdomain_hunter.py --domain example.com --takeover-only

As OpenClaw Discord Command

In #edgeiq-support channel:

!subdomain example.com
!subdomain example.com --takeover
!subdomain example.com --bruteforce

---

Parameters

Flag	Type	Default	Description
--domain	string	—	Target domain
--pro	flag	False	Enable Pro features
--bundle	flag	False	Enable Bundle features
--bruteforce	flag	False	Run common subdomain wordlist
--takeover	flag	False	Run takeover detection
--takeover-only	flag	False	Only run takeover detection
--output	string	—	Write JSON report to file
--threads	int	20/50	Concurrent threads (Pro/Bundle)

---

Output Example

=== Subdomain Hunter ===
example.com
  CT Entries:    47
  Resolved:      31
  Dead:          5
  Takeovers:     2 🔴

  Discovered subdomains:
    api.example.com         ✅ resolves → 1.2.3.4
    staging.example.com    ✅ resolves → 1.2.3.5
    dev.example.com         ❌ DEAD (CNAME to Heroku)
    old.example.com         🔴 TAKEOVER (no CNAME, 404)
    blog.example.com        ✅ resolves → 1.2.3.6

  Zone Transfer:  BLOCKED
  Threat Level:  MEDIUM

---

Pro Upgrade

Unlimited CT results, takeover detection, bruteforce wordlist, and JSON export:

👉 Upgrade to Pro — $19/mo

---

Support

Open a ticket in #edgeiq-support or email [e-mail]