Wstg Conf 10

wstg-conf-10

Test ID

WSTG-CONF-10

Test Name

Test for Subdomain Takeover

High-Level Description

Subdomain takeover occurs when a subdomain's DNS record points to an external service that is no longer in use or has been deleted. Attackers can claim the abandoned resource and host their own content on the victim's subdomain. This can lead to credential theft, phishing, cookie stealing, and reputation damage. Common targets include cloud services (AWS, Azure, GitHub Pages), CDNs, and SaaS platforms.

What to Check

DNS Record Types

• A records pointing to decommissioned IPs
• CNAME records pointing to unclaimed services
• NS records pointing to expired domains
• MX records pointing to abandoned mail services

Vulnerable Services

How to Test

Step 1: Subdomain Enumeration

# Amass
amass enum -d target.com -o subdomains.txt

# Subfinder
subfinder -d target.com -o subdomains.txt

# Assetfinder
assetfinder target.com >> subdomains.txt

# Certificate Transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt

# Combine and dedupe
sort -u subdomains.txt -o subdomains.txt

Step 2: DNS Resolution Check

#!/bin/bash
# Check DNS status for each subdomain

while read subdomain; do
    result=$(dig +short "$subdomain")
    if [ -z "$result" ]; then
        echo "[NXDOMAIN] $subdomain"
    else
        echo "[RESOLVED] $subdomain -> $result"
    fi
done < subdomains.txt

Step 3: Identify CNAME Records

# Check CNAME records
while read subdomain; do
    cname=$(dig +short CNAME "$subdomain")
    if [ ! -z "$cname" ]; then
        echo "$subdomain -> CNAME: $cname"

        # Check if CNAME target resolves
        target_ip=$(dig +short "$cname")
        if [ -z "$target_ip" ]; then
            echo "  [!] POTENTIAL TAKEOVER: CNAME target doesn't resolve!"
        fi
    fi
done < subdomains.txt

Step 4: Check for Vulnerable Services

#!/bin/bash
# Check HTTP response for takeover indicators

while read subdomain; do
    response=$(curl -s -L -o /dev/null -w "%{http_code}" "https://$subdomain" 2>/dev/null)

    if [ "$response" == "000" ]; then
        # Connection failed - check CNAME
        cname=$(dig +short CNAME "$subdomain")
        if [ ! -z "$cname" ]; then
            echo "[CHECK] $subdomain (CNAME: $cname) - No HTTP response"
        fi
    elif [ "$response" == "404" ]; then
        # Get page content
        content=$(curl -s -L "https://$subdomain" 2>/dev/null)

        # Check for known vulnerable patterns
        if echo "$content" | grep -qi "There isn't a GitHub Pages site here"; then
            echo "[VULN] $subdomain - GitHub Pages takeover!"
        elif echo "$content" | grep -qi "NoSuchBucket"; then
            echo "[VULN] $subdomain - AWS S3 takeover!"
        elif echo "$content" | grep -qi "No such app"; then
            echo "[VULN] $subdomain - Heroku takeover!"
        elif echo "$content" | grep -qi "this shop is currently unavailable"; then
            echo "[VULN] $subdomain - Shopify takeover!"
        else
            echo "[CHECK] $subdomain - 404 response, manual check needed"
        fi
    fi
done < subdomains.txt

Step 5: Check NS Records

# Check for dangling NS records
ns_records=$(dig +short NS target.com)
for ns in $ns_records; do
    # Check if NS resolves
    ns_ip=$(dig +short "$ns")
    if [ -z "$ns_ip" ]; then
        echo "[CRITICAL] NS record doesn't resolve: $ns"
    fi

    # Check if NS domain is available for registration
    whois "${ns%.}" | grep -i "No match\|not found"
done

Step 6: Use Automated Tools

# Subjack
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -ssl

# Nuclei subdomain takeover templates
nuclei -l subdomains.txt -t http/takeovers/

# Can-I-Take-Over-XYZ check
# Reference: https://github.com/EdOverflow/can-i-take-over-xyz

Tools

Subdomain Enumeration

Takeover Detection

DNS Tools

Example Commands/Payloads

Comprehensive Takeover Scanner

#!/bin/bash
TARGET=$1
OUTPUT_DIR="takeover_scan_$(date +%Y%m%d)"
mkdir -p $OUTPUT_DIR

echo "=== SUBDOMAIN TAKEOVER SCAN ==="
echo "Target: $TARGET"
echo ""

# 1. Enumerate subdomains
echo "[+] Enumerating subdomains..."
subfinder -d $TARGET -silent > "$OUTPUT_DIR/subdomains_subfinder.txt"
amass enum -passive -d $TARGET -o "$OUTPUT_DIR/subdomains_amass.txt" 2>/dev/null
curl -s "https://crt.sh/?q=%.$TARGET&output=json" | jq -r '.[].name_value' 2>/dev/null | sort -u > "$OUTPUT_DIR/subdomains_crt.txt"

# Combine
cat "$OUTPUT_DIR"/subdomains_*.txt | sort -u > "$OUTPUT_DIR/all_subdomains.txt"
echo "Found $(wc -l < "$OUTPUT_DIR/all_subdomains.txt") unique subdomains"

# 2. Check DNS resolution
echo ""
echo "[+] Checking DNS resolution..."
while read sub; do
    cname=$(dig +short CNAME "$sub" 2>/dev/null)
    if [ ! -z "$cname" ]; then
        echo "$sub,$cname" >> "$OUTPUT_DIR/cname_records.txt"
    fi
done < "$OUTPUT_DIR/all_subdomains.txt"

# 3. Run subjack
echo ""
echo "[+] Running subjack..."
subjack -w "$OUTPUT_DIR/all_subdomains.txt" -t 100 -timeout 30 -o "$OUTPUT_DIR/subjack_results.txt" -ssl -a 2>/dev/null

# 4. Run nuclei takeover templates
echo ""
echo "[+] Running nuclei takeover checks..."
nuclei -l "$OUTPUT_DIR/all_subdomains.txt" -t http/takeovers/ -o "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null

# Results
echo ""
echo "[+] Scan complete. Results in $OUTPUT_DIR/"
echo "Potential takeovers:"
cat "$OUTPUT_DIR/subjack_results.txt" 2>/dev/null
cat "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null

Subjack Usage

# Install
go install github.com/haccer/subjack@latest

# Basic scan
subjack -w subdomains.txt -t 100 -timeout 30 -ssl

# With output
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -o results.txt

# Verbose
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -v

Nuclei Takeover Templates

# Run all takeover templates
nuclei -l subdomains.txt -t http/takeovers/

# Specific service
nuclei -l subdomains.txt -t http/takeovers/github-takeover.yaml
nuclei -l subdomains.txt -t http/takeovers/aws-bucket-takeover.yaml

Remediation Guide

1. Remove Dangling DNS Records

# Identify and remove unused DNS records
# In DNS management console:
# - Delete CNAME records pointing to decommissioned services
# - Delete A records pointing to released IPs
# - Update NS records if domains expired

2. Continuous Monitoring

# Set up regular scanning
# Add to cron:
0 0 * * * /path/to/takeover_scan.sh target.com

# Use OWASP Domain Protect or similar

3. Service Decommissioning Checklist

1. Remove service/application
2. Remove DNS records pointing to service
3. Update documentation
4. Verify DNS cleanup

4. Preventive Measures

• Maintain inventory of all subdomains
• Document all external service integrations
• Implement DNS record change alerts
• Regular subdomain audits
• Use TXT records to verify ownership before creating CNAMEs

Risk Assessment

CVSS Score

Subdomain Takeover

• Base Score: 8.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Impact

• Phishing attacks from trusted subdomain
• Cookie stealing (if parent domain)
• Credential harvesting
• Malware distribution
• Brand/reputation damage
• SEO manipulation

CWE Categories

References

• OWASP WSTG - Test for Subdomain Takeover
• Can I Take Over XYZ?
• Subjack
• OWASP Amass

Checklist

[ ] Subdomain enumeration completed
[ ] DNS records analyzed (A, CNAME, NS)
[ ] CNAME targets verified
[ ] Dangling records identified
[ ] HTTP responses checked for takeover indicators
[ ] Automated tools run (subjack, nuclei)
[ ] NS records verified
[ ] Expired domains checked
[ ] Vulnerable subdomains documented
[ ] Risk assessment completed
[ ] Remediation plan provided