{
  "slug": "subdomain-takeover",
  "title": "Subdomain Takeover",
  "phase": "Exploitation",
  "description": "Identify and verify dangling DNS records pointing to deprovisioned cloud services that can be claimed by an attacker.",
  "difficulty": "medium",
  "tags": [
    "exploitation",
    "subdomain-takeover",
    "dns",
    "cloud",
    "dangling-records"
  ],
  "tools": [
    "subjack",
    "nuclei",
    "can-i-take-over-xyz",
    "dig",
    "httpx"
  ],
  "steps": [
    {
      "id": "subtko-01",
      "title": "Identify CNAME records pointing to external services",
      "description": "Resolve DNS records for all enumerated subdomains and flag CNAMEs that point to third-party cloud services (S3, GitHub Pages, Heroku, Azure, Shopify, Fastly).",
      "commands": [
        "cat subdomains.txt | xargs -I{} dig CNAME {} +short",
        "httpx -l subdomains.txt -follow-redirects -status-code -title -o httpx-subs.txt",
        "subjack -w subdomains.txt -t 100 -timeout 30 -o subjack-results.txt -ssl"
      ],
      "notes": "Pipe the CNAME output through sort -u and cross-reference with the can-i-take-over-xyz list to identify vulnerable providers."
    },
    {
      "id": "subtko-02",
      "title": "Check for dangling records",
      "description": "Verify that identified CNAMEs resolve to NXDOMAIN or return provider-specific error pages indicating the resource is unclaimed.",
      "commands": [
        "dig CNAME blog.target.com +short",
        "curl -sk https://blog.target.com -o /dev/null -w '%{http_code}'",
        "nuclei -l subdomains.txt -t takeovers/ -o takeover-results.txt"
      ],
      "notes": "An NXDOMAIN response on the CNAME target combined with an active CNAME record on the subdomain is the classic indicator of a takeover opportunity."
    },
    {
      "id": "subtko-03",
      "title": "Verify takeover feasibility per provider",
      "description": "Confirm that the specific cloud provider allows claiming the dangling resource by consulting provider-specific documentation and the can-i-take-over-xyz fingerprint database.",
      "commands": [
        "curl -sk https://subdomain.target.com | grep -i 'There isn.t a GitHub Pages site here'",
        "curl -sk https://subdomain.target.com | grep -i 'NoSuchBucket'",
        "curl -sk https://subdomain.target.com | grep -i 'no such app'"
      ],
      "notes": "Not all dangling CNAMEs are exploitable — some providers do not allow registration of previously used resource names. Always check can-i-take-over-xyz for the current status."
    },
    {
      "id": "subtko-04",
      "title": "Test for NS delegation takeover",
      "description": "Check whether any subdomain has NS records pointing to nameservers that can be registered, allowing full DNS control over the subdomain.",
      "commands": [
        "dig NS target.com +short",
        "cat subdomains.txt | xargs -I{} dig NS {} +short | sort -u"
      ],
      "notes": "NS delegation takeover is higher impact than CNAME takeover because it grants full DNS control, enabling the attacker to set arbitrary A, MX, and TXT records."
    },
    {
      "id": "subtko-05",
      "title": "Document proof of concept safely",
      "description": "Claim the dangling resource on the target provider and serve a benign proof-of-concept page (e.g. a text file with your researcher handle) without impersonating the target.",
      "commands": [
        "echo 'This subdomain is vulnerable to takeover. Reported by <researcher-handle>.' > index.html"
      ],
      "notes": "Never serve content that impersonates the target organisation, collects credentials, or serves malicious code. A simple text file is sufficient proof."
    },
    {
      "id": "subtko-06",
      "title": "Check for wildcard DNS impact",
      "description": "Determine whether the target uses wildcard DNS records that may mask or amplify the impact of a subdomain takeover.",
      "commands": [
        "dig A *.target.com +short",
        "dig A randomnonexistent12345.target.com +short"
      ],
      "notes": "If a wildcard record exists, any subdomain that is not explicitly defined will resolve to the wildcard. This can make takeover detection harder and impact assessment broader."
    }
  ],
  "references": [
    "https://github.com/EdOverflow/can-i-take-over-xyz",
    "https://github.com/haccer/subjack",
    "https://portswigger.net/web-security/host-header/exploiting",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover",
    "https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}