cyberstrikeus Subdomain Takeover
Objective
Identify subdomains with dangling DNS records (CNAME pointing to unclaimed cloud resources) and claim them to serve attacker content.
Testing Methodology
Phase 1: Subdomain Enumeration
# Passive enumeration
subfinder -d TARGET.com -silent | tee subdomains.txt
# Certificate transparency
curl -s "https://crt.sh/?q=%25.TARGET.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt
# DNS brute force
puredns bruteforce wordlist.txt TARGET.com -r resolvers.txt >> subdomains.txt
Phase 2: Automated Takeover Check
# Check all subdomains for takeover
attack_script subdomain_takeover subdomains.txt --json-output
Checks 20 cloud services:
- GitHub Pages, Heroku, Shopify, Tumblr, WordPress
- AWS S3, AWS Elastic Beanstalk, Azure Web Apps
- Netlify, Vercel, Fastly, Fly.io
- Bitbucket, Surge, Ghost, Pantheon
- Zendesk, README.io, Cargo, Feedpress
Phase 3: Manual CNAME Verification
# Check CNAME records
dig +short CNAME subdomain.TARGET.com
# Verify the pointed service is unclaimed
curl -s https://subdomain.TARGET.com
# Look for: "There isn't a GitHub Pages site here"
# "No such app" (Heroku)
# "NoSuchBucket" (S3)
Phase 4: Cloud Storage Enumeration
# Check related cloud buckets
attack_script cloud_storage_enum TARGET --json-output
Phase 5: Claim & Verify
After confirming a dangling CNAME:
- Create the resource on the target service (e.g., GitHub Pages repo, S3 bucket)
- Serve a harmless proof page (e.g.,
cyberstrike-takeover-proof.html) - Verify it's accessible at
subdomain.TARGET.com
What Constitutes a Finding
| Finding | Severity |
|---|---|
| Subdomain takeover — attacker controls content | High (P2) |
| S3 bucket public write access | Critical (P1) |
| S3 bucket listing enabled | High (P2) |
| Dangling CNAME (service unreachable) | Medium (P3) |
| Cloud storage public read | Medium (P3) |
Evidence Requirements
- Subdomain with dangling CNAME record
- Target cloud service identified
- Service fingerprint (error message)
- For takeover: proof of content hosting on subdomain
- For buckets: listing output or write proof
Tools
attack_script subdomain_takeover— automated CNAME + fingerprint checkerattack_script cloud_storage_enum— S3/Azure/GCP enumerationsubfinder,puredns— subdomain enumeration