How do I install the Web Subdomain Takeover skill?

Run npx skillmds@latest add noorqureshi/web-subdomain-takeover in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Subdomain Takeover safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Subdomain Takeover?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Subdomain Takeover free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Subdomain Takeover?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Subdomain Takeover by noorqureshi

Name: Web Subdomain Takeover
Author: NoorQureshi

Web Subdomain Takeover

Claim a dangling DNS record pointing to a deprovisioned service (subdomain takeover). Load after subdomain enum, on CNAMEs to cloud services, "NoSuchBucket"/"404 there isn't a GitHub Pages site here", or dangling A/CNAME. Signals: CNAME → S3/GitHub/Heroku/Azure/Fastly with a fingerprint error page.

NoorQureshi Updated Sep 17, 2026

File contents

Subdomain takeover

When it applies

A subdomain's DNS still points (CNAME/A) to a third-party service that no longer has the resource provisioned, so you can register it and serve content on the victim's subdomain.

Why it works

The org deleted the S3 bucket / GitHub Pages / Heroku app but left the DNS record. The provider now serves that hostname to whoever claims the resource next — you. You control content on a trusted subdomain (phishing, cookie theft on the parent domain, OAuth redirect_uri allowlist).

Method

Find candidates: from subdomain enum, resolve CNAMEs (dig CNAME sub.target.com) and look for third-party targets with a "not claimed" fingerprint (nuclei -t takeovers, subjack).
Confirm the fingerprint: the provider's specific unclaimed-resource error (e.g. S3 NoSuchBucket, GitHub Pages 404, Heroku "no such app").
Claim it: register the exact resource name on that provider (bucket/app/pages repo) and serve a proof file — do NOT phish; a harmless proof page is the report.
Assess chained impact: cookie scope on parent domain, OAuth redirect_uri allowlist, CSP script-src including the subdomain, SPF/email.

Gotchas

Only some providers are claimable and only with the right fingerprint — a generic 404 isn't takeover.
Prove with a benign marker page; don't collect data or run phishing.
Note the chained impact (why it matters) — a bare takeover of an unused subdomain may be low without it.

Verify success

You serve attacker-controlled content at the victim's subdomain (proof file loads at sub.target.com), captured with the DNS record + your claimed resource.

References

can-i-take-over-xyz; subjack/nuclei takeover templates; HackerOne takeover reports.

---name: web-subdomain-takeoverdescription: Claim a dangling DNS record pointing to a deprovisioned service (subdomain takeover). Load after subdomain enum, on CNAMEs to cloud services, "NoSuchBucket"/"404 there isn't a GitHub Pages site here", or dangling A/CNAME. Signals: CNAME → S3/GitHub/Heroku/Azure/Fastly with a fingerprint error page.---# Subdomain takeover## When it appliesA subdomain's DNS still points (CNAME/A) to a third-party service that no longer has theresource provisioned, so you can register it and serve content on the victim's subdomain.## Why it worksThe org deleted the S3 bucket / GitHub Pages / Heroku app but left the DNS record. The providernow serves that hostname to whoever claims the resource next — you. You control content on atrusted subdomain (phishing, cookie theft on the parent domain, OAuth redirect_uri allowlist).## Method1. **Find candidates**: from subdomain enum, resolve CNAMEs (`dig CNAME sub.target.com`) and look for third-party targets with a "not claimed" fingerprint (`nuclei -t takeovers`, `subjack`).2. **Confirm the fingerprint**: the provider's specific unclaimed-resource error (e.g. S3 `NoSuchBucket`, GitHub Pages 404, Heroku "no such app").3. **Claim it**: register the exact resource name on that provider (bucket/app/pages repo) and serve a proof file — do NOT phish; a harmless proof page is the report.4. **Assess chained impact**: cookie scope on parent domain, OAuth `redirect_uri` allowlist, CSP `script-src` including the subdomain, SPF/email.## Gotchas- Only some providers are claimable and only with the right fingerprint — a generic 404 isn't takeover.- Prove with a benign marker page; don't collect data or run phishing.- Note the chained impact (why it matters) — a bare takeover of an unused subdomain may be low without it.## Verify successYou serve attacker-controlled content at the victim's subdomain (proof file loads at`sub.target.com`), captured with the DNS record + your claimed resource.## Referencescan-i-take-over-xyz; subjack/nuclei takeover templates; HackerOne takeover reports.

Frequently asked questions