dreadnode · GangGreenTemperTatum · Aug 25, 2026 · Aug 25, 2026
diff --git a/capabilities/web-security/agents/web-security.md b/capabilities/web-security/agents/web-security.md
@@ -106,6 +106,7 @@ Any tool that scans, fuzzes, or floods runs on shared local hardware. Cap concur
 - Use `generate_rebinding_hostname` and `list_rebinding_presets` for DNS rebinding SSRF bypass when IP filters validate resolved addresses before fetching.
 - Use the `agentmail_*` tools (`agentmail_list_inboxes`, `agentmail_create_inbox`, `agentmail_list_messages`, `agentmail_get_message`, `agentmail_send_message`, `agentmail_reply_message`) to work with AgentMail email inboxes when a real, agent-owned email address is useful — for example signup, recovery, or email-verification flows. Requires an AgentMail API key via the `AGENTMAIL_API_KEY` environment variable or the `api_key` argument. Available only when the key is configured.
 - Use IP rotation (`flareprox_*` tools or the local `fireprox` CLI at `~/git/fireprox/fire.py`) only when `IPROTATE_ENABLED` is set and the target is rate-limiting, IP-banning, or WAF-blocking normal requests. Load the `ip-rotation` skill for backend selection and lifecycle. Always clean up fireprox proxies to avoid AWS charges.
+- Use geo-distributed DNS resolution (`check_geo_resolver_readiness`, `discover_open_resolvers`, `resolve_via_open_resolvers`) only when `GEO_RESOLVERS_ENABLED` is set and a Shodan or Censys API key is available. This discovers open recursive resolvers per country to resolve hostnames from multiple geographic vantage points, revealing geo-fenced infrastructure invisible from a single location. Load the `distributed-routing-testing` skill for the full workflow. This is orthogonal to IP rotation: IP rotation changes the egress IP for HTTP requests, geo-distributed DNS changes the resolver location for DNS queries.
 - Use the local `pacu` CLI when an authorized test yields AWS credentials, cloud metadata access, or another AWS-impact lead that needs validation. Load the `pacu-aws-exploitation` skill first, confirm AWS scope, and start with identity/read-only enumeration before any mutating module.
 - When the target accepts or extracts archive uploads (ZIP, TAR, etc.), use the local `archive-alchemist` CLI at `~/git/archivealchemist/archive-alchemist.py` to craft malicious archives. Load the `archive-path-traversal` skill for the full attack pattern catalog and iterative workflow.
 - Use `exif_read`, `exif_write`, `exif_strip`, and `exif_copy` for EXIF/XMP/IPTC metadata manipulation on image and document files. Primary use cases: injecting XSS payloads into metadata fields (Comment, Artist, Copyright, ImageDescription) that get rendered by the target, crafting images with SSRF-triggering metadata for server-side processing, testing whether upload handlers strip metadata, and transplanting payloads between file formats. Strip metadata first with `exif_strip` to create a clean baseline, then inject specific payloads with `exif_write`.

diff --git a/capabilities/web-security/capability.yaml b/capabilities/web-security/capability.yaml
@@ -1,12 +1,14 @@
 schema: 1
 name: web-security
-version: "1.12.0"
+version: "1.13.0"
 description: >
-  Web application penetration testing with 82 attack technique playbooks
+  Web application penetration testing with 83 attack technique playbooks
   covering HTTP desync/request smuggling, cache poisoning, SSRF, SSTI, DOM
   vulnerabilities, authentication bypasses, parser differentials,
   AEM/Sling exploitation, GraphQL, OAuth, and client-side attacks.
-  Includes HTTP client tooling with OOB callbacks via webhook.site
+  Includes geo-distributed DNS resolution via in-region open resolvers
+  (Shodan/Censys) for detecting geo-fenced infrastructure,
+  HTTP client tooling with OOB callbacks via webhook.site
   (API-key aware) and interactsh, four coexisting Caido surfaces
   (caido-cli server, the Python caido-sdk-client, lightweight and
   full-surface MCP servers, and the caido-mode TypeScript SDK CLI on
@@ -244,4 +246,10 @@ keywords:
   - interactsh
   - oob-callbacks
   - securitycontext
+  - geo-dns
+  - geo-fencing
+  - open-resolvers
+  - shodan
+  - censys
+  - distributed-routing
   - caido
diff --git a/capabilities/web-security/skills/distributed-routing-testing/SKILL.md b/capabilities/web-security/skills/distributed-routing-testing/SKILL.md
@@ -0,0 +1,119 @@
+---
+name: distributed-routing-testing
+description: Geo-distributed DNS resolution via in-region open resolvers (Shodan/Censys) to detect geo-fenced infrastructure, GSLB-routed backends, and region-specific endpoints invisible from a single vantage point. Use when the target appears to serve different infrastructure per region, when encountering geo-blocking or geo-fencing, or when recon from a single location misses region-locked assets.
+---
+
+# Distributed Routing Testing
+
+**Activation gate:** Only use this skill when `GEO_RESOLVERS_ENABLED` is set (any value). If unset, do not suggest, reference, or offer geo-distributed resolution. Do not ask the user to enable it.
+
+**Credential requirement:** At least one of `SHODAN_API_KEY` or `CENSYS_PAT` must be set. When both are present, `auto` selects Shodan first (cheaper credit cost for this query pattern).
+
+## Concept
+
+Some targets use geo-aware authoritative nameservers, GSLB appliances, or geo-fenced edges that return different A/AAAA records depending on where the DNS **resolver** sits. From a single vantage point you only ever see your own region's answer — the target's region-specific infrastructure is invisible.
+
+This is orthogonal to IP rotation (`flareprox`/`fireprox`): those change the **egress IP** of an HTTP request; this changes the **vantage point** of a DNS lookup.
+
+Open recursive resolvers physically located in different countries act as regional vantage points. Querying the same hostname through resolvers in DE, SG, BR, JP reveals whether the authoritative nameserver hands back different addresses per region.
+
+## When to Use
+
+- **Geo-fencing detected:** target returns `403`, `451`, or redirects to a regional portal based on client geography
+- **CDN/GSLB in use:** multiple A records, Anycast ranges, or `X-Served-By` headers suggesting regional routing
+- **Recon gap:** subfinder/httpx/nuclei from a single location may miss region-locked subdomains or IP ranges
+- **Scope expansion:** in-scope CIDRs may only cover one region; geo-differentiated DNS reveals whether more infra exists elsewhere
+
+## When NOT to Use
+
+- Routine DNS lookups from the local resolver (use `dnsx` instead)
+- When `GEO_RESOLVERS_ENABLED` is not set
+- For resolving internal/private hostnames (open resolvers cannot reach them)
+
+## Workflow
+
+### 1. Check readiness
+
+```
+check_geo_resolver_readiness
+```
+
+Confirms the gate is set, which provider keys are present, and how many resolvers are cached.
+
+### 2. Discover resolvers
+
+```
+discover_open_resolvers  countries="US,DE,SG,JP,BR,AU"  provider="auto"
+```
+
+Queries Shodan or Censys for hosts running recursive DNS in each country, then **verifies** each candidate actually resolves a known hostname to its correct answer. Hijacking resolvers that serve ads or NXDOMAIN-redirect are discarded — they would produce false geo-divergence.
+
+Results are cached **in memory only** for this session.
+
+| Parameter | Default | Notes |
+|---|---|---|
+| `countries` | (required) | ISO-3166 codes, max 20 |
+| `provider` | `auto` | `shodan`, `censys`, or `auto` |
+| `max_per_country` | `2` | Verified resolvers per country, 1-5 |
+| `verify` | `true` | Probe candidates against a known hostname; strongly recommended |
+
+### 3. Resolve and diff
+
+```
+resolve_via_open_resolvers  hostnames="target.example.com,api.example.com"
+```
+
+For each hostname, queries every cached resolver and compares the per-country answers against a local baseline (`1.1.1.1` by default). The output tells you:
+
+- **`geo_differentiated`:** whether any country sees different addresses
+- **`addresses_only_seen_regionally`:** IPs invisible from your local vantage — the actionable new surface
+- **`answers_by_country`:** full answer set per country
+- **`unreachable_resolvers`:** resolvers that timed out (expected — open resolvers are unreliable)
+
+| Parameter | Default | Notes |
+|---|---|---|
+| `hostnames` | (required) | Comma-separated, max 25 per call |
+| `countries` | all cached | Filter to specific countries |
+| `record_type` | `A` | `A` or `AAAA` |
+| `baseline_resolver` | `1.1.1.1` | Override for the local baseline |
+
+### 4. Interpret results
+
+When `geo_differentiated` is `true`:
+
+1. **Check scope.** The region-specific IPs may belong to a different org, CDN, or cloud account. Confirm they fall within the engagement scope before probing.
+2. **Differentiate CDN geo-routing from target-owned infra.** CDN Anycast addresses (Cloudflare, Akamai, Fastly) appear as divergent but are expected — they're the CDN serving regional PoPs, not hidden target infra. Compare ASNs.
+3. **Probe from the right region.** If the target's infra is genuinely geo-locked, you may need IP rotation (`flareprox`/`fireprox` via the `ip-rotation` skill) to reach it over HTTP.
+4. **Feed new IPs back into recon.** Run `httpx`, `nuclei`, and `tlsx` against the newly discovered addresses.
+
+### 5. Clean up
+
+```
+clear_open_resolver_cache
+```
+
+Discard cached resolvers. Do this when switching engagements.
+
+## Provider Reference
+
+### Shodan (`SHODAN_API_KEY`)
+
+- Query: `port:53 country:{CC} "Recursion: enabled"`
+- Auth: `?key=` query parameter
+- Cost: 1 query credit per country (filters consume credits)
+- Typical yield: 10-100 candidates per country
+
+### Censys (`CENSYS_PAT` / `CENSYS_API_KEY`)
+
+- Query: `host.services: (port=53 and protocol=DNS) and host.location.country_code="{CC}"`
+- Auth: `Authorization: Bearer` header
+- Optional: `CENSYS_ORGANIZATION_ID` for org-scoped access (required for Starter+)
+- Cost: 1 API credit per query
+- Typical yield: 5-50 candidates per country
+
+## Constraints
+
+- **Open resolvers are unreliable.** They go offline, get patched, or lie. Verification filters out liars but cannot guarantee availability. Re-discover if results degrade.
+- **Rate cap.** Max 20 countries, 25 hostnames, 5 resolvers per country. This prevents runaway credit consumption and excessive probing of third-party infrastructure.
+- **Session-scoped.** Nothing is written to disk. Resolvers are cached in memory and disappear when the session ends.
+- **UDP only.** Queries use raw UDP to port 53. Environments that block outbound UDP/53 (some cloud sandboxes) will fail silently — check `unreachable_resolvers` in the output.