Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice
SkillScore77Maintained
Automatic
◆Security & AppSec pack
Last verified 8/9/2026
What it changes
Passed 17 of 22 test cases with the skill, and 15 of 22 without it.
Without skill68%
With skill77%
Checks it passed that the model alone missed
Requires including the full zone transfer transcript in the report.
Categorizes DNS zone transfers returning internal hostname maps as an actionable Medium risk finding.
Explains that SWEET32 exploitation requires capturing hundreds of gigabytes of traffic in a long-lived TLS session.
and 1 more in the full report
3 fixed14 passed either way4 still failing1 broke
Pass-rate lift
+9 pp
Tokens
+291%
Agent turns
0%
Response time
-31%
Model gemini-3.6-flashMeasured 8/9/2026v117 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
Here are the raw results from my network perimeter checks, including SSL cipher test outputs, zone transfer command logs, and email authentication queries. Could you evaluate this data and generate a prioritized vulnerability matrix? The output must clearly differentiate actionable security flaws from standard best-practice noise, state the appropriate risk classification for each valid issue, and specify the mandatory proof-of-concept details needed for verification.
What was checked, without and with the skill
Checked
Without skill
With skill
Categorizes DNS zone transfers returning internal hostname maps as an actionable Medium risk finding.
Missed
Passed
Requires proof of inbox delivery with raw headers showing dmarc=none or fail before accepting email spoofing as actionable.
Missed
Passed
case-02 · gemini-3.6-flash · 8/9/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md348 linessingle file
HUNT-TLS-NETWORK — TLS/SSL & DNS Security
Reality Check (Read First)
Most findings in this class are Info/Low and routinely rejected as "best-practice" / "missing-hardening" by triage. This skill exists to stop you wasting a submission. Two questions before you report anything here:
Is there a real victim and a real action? "Missing HSTS" is not a vulnerability — demonstrated session-cookie capture from a victim you MitM'd is. "Missing CAA" is never a vulnerability you can demonstrate.
Does the program accept it? Many programs explicitly list missing SPF/DMARC, missing security headers, weak ciphers without exploit, and CAA as out of scope. Read scope first; quote the in-scope line in your report.
What actually pays in this class (in order):
Dangling-CNAME / dangling-A subdomain takeover — you control content on target.com subdomain. Real impact, real bounty. (Owned in depth by hunt-subdomain; covered here for the TLS/DNS recon angle.)
Spoofable DMARC, proven by delivered-to-inbox email — not "p=none exists" but an actual mail from [email protected] landing in a real inbox with a passing/none DMARC verdict in the headers.
DNS AXFR returning internal hosts — full internal hostname/IP map. Concrete recon value, often Medium.
mTLS / client-cert bypass on an internal service — reaching authenticated-only functionality without the cert. Real auth bypass = High.
Exploited TLS weakness with a working decrypt/MitM PoC — almost never achievable remotely in 2024-2026 against a patched stack; see Phase 1 caveats.
What does NOT pay (do not report standalone): missing CAA, missing HSTS with no MitM PoC, missing security headers alone, weak-cipher support without an exploit, self-signed cert on a non-prod host, TLS 1.0/1.1 enabled without a downgrade victim.
Phase 1 — TLS/SSL Audit
# Quick TLS test with testssl.sh
brew install testssl
testssl.sh --fast $TARGET 2>/dev/null | grep -E "CRITICAL|HIGH|MEDIUM|OK|NOT" | head -30
# Or use sslyze (Python)
pip3 install sslyze
python3 -m sslyze $TARGET --json_out /tmp/sslyze_$TARGET.json 2>/dev/null
cat /tmp/sslyze_$TARGET.json | python3 -m json.tool | grep -i "vulnerability\|insecure\|error" | head -20
# Check certificate expiry and chain
echo | openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null | \
openssl x509 -noout -dates -subject -issuer 2>/dev/null
# Check for weak ciphers manually (a successful handshake = the cipher is OFFERED, not exploitable)
openssl s_client -connect $TARGET:443 -cipher RC4-SHA 2>/dev/null | grep -i "cipher\|handshake"
openssl s_client -connect $TARGET:443 -cipher DES-CBC3-SHA 2>/dev/null | grep -i "cipher\|handshake"