Subdomain Takeover Hunt

Subdomain Takeover Detection

Detect subdomains pointing to unregistered or unclaimed third-party cloud services. When a CNAME record points to a service that no longer exists, an attacker can register that resource and serve arbitrary content under the target's subdomain — enabling phishing, cookie theft, and full origin impersonation.

When to Use

• Subdomain enumeration produces a large list — scan for lingering DNS records.
• Target uses cloud services with shared-namespace identifiers (Heroku, S3, Azure, Zendesk, Shopify).
• A subdomain returns NXDOMAIN, 404, or "no such app" error pages.
• The CNAME target is a service with user-registrable names.

Prerequisites

• terminal with curl, dnsx, subfinder.
• subzy or subjack installed for automated detection.
• List of alive subdomains from subdomain-enumeration.

Quick Detection

# DNS resolution with CNAME extraction
dnsx -retry 3 -a -cname -resp -silent -l alive_subs.txt | tee dns_records.txt

# Automated takeover scan
subzy run --targets alive_subs.txt --hide_fails --vuln

Procedure

Phase 1 — Extract CNAME Records

# Get all CNAME records
cat alive_subs.txt | dnsx -silent -cname -resp-only > cname_targets.txt

# Filter to suspicious services
grep -iE "heroku|s3\.amazonaws|azure|zendesk|shopify|github\.io|bitbucket|surge\.sh|netlify|vercel|ghost\.io|readme|statuspage|pantheon|desk\.com|campaignmonitor|intercom|unbounce|wordpress\.com|cargo\.collective" \
  cname_targets.txt > takeover_candidates.txt

Phase 2 — Automated Detection

# subzy — fast, shows vulnerable + fingerprint
subzy run --targets alive_subs.txt --hide_fails --vuln

# subjack — with custom fingerprints
subjack -w alive_subs.txt -t 100 -timeout 30 -o takeover_results.txt \
  -ssl -c ~/subjack/fingerprints.json -v

# nuclei — takeover templates
nuclei -l alive_subs.txt \
  -t nuclei-templates/takeovers/ \
  -o nuclei_takeover_results.txt

Phase 3 — Manual Verification

# For each candidate, verify the service is claimable
CANDIDATE="api.target.com"

# Check what the CNAME points to
dig $CANDIDATE CNAME +short

# Check HTTP response
curl --max-time 30 --connect-timeout 10 -skI "https://$CANDIDATE" | head -10

# Key service-specific verification:

# Heroku: visit https://CANDIDATE — "no such app" = claimable
# S3: curl -s https://BUCKET_NAME.s3.amazonaws.com — 404 NoSuchBucket = claimable
# Zendesk: visit https://CANDIDATE — "account not found" = claimable
# GitHub Pages: dig CNAME returns user.github.io — 404 = claimable
# Azure: visit https://CANDIDATE — "tenant not found" = claimable
# Shopify: visit https://CANDIDATE — "Sorry, this shop is currently unavailable"

Phase 4 — S3 Takeover Pipeline

subfinder -d target.com -silent \
  | dnsx -silent -cname \
  | grep "s3.amazonaws" \
  | while read line; do
      sub=$(echo "$line" | awk '{print $1}' | sed 's/\.$//')
      curl --max-time 30 --connect-timeout 10 -sk "https://$sub" | grep -q "NoSuchBucket" && echo "CLAIMABLE: $sub"
    done

Phase 5 — Service Fingerprint Reference

Pitfalls

• Resolving CNAME to a CDN service is not a finding. Cloudflare/CloudFront/Akamai subdomains are not claimable.
• The CNAME may point to a valid, in-use service. Always verify the error page before claiming a finding.
• Some services block automated scanners. Visit the URL in a browser to confirm.
• Subdomain takeover requires registration of the target resource. Never register resources without explicit authorization.
• Wildcard DNS (*.target.com → IP) produces false positives. Filter out wildcard responses before scanning for takeover.

Verification

1. dig SUBDOMAIN CNAME +short returns a service with user-registrable namespace.
2. curl --max-time 30 --connect-timeout 10 -sk https://SUBDOMAIN returns the service-specific error page indicating the resource is available.
3. The CNAME target is NOT resolving to a CDN or load balancer.
4. Document the exact error message and service type before reporting.

Related Skills

• subdomain-enumeration — Generate the subdomain list for takeover scanning.
• origin-ip-discovery — If takeover is found, check if the same IP hosts other services.
• port-service-discovery — Scan the CNAME-resolved IP for additional exposed services.