Subdomain Takeover Risk

Detects CNAME records pointing to cloud services that may be dangling, and configurations referencing external services vulnerable to takeover.

zakirkun Updated

File contents

Subdomain Takeover Risk

Overview

Subdomain takeover occurs when a DNS CNAME points to a third-party service (GitHub Pages, Heroku, S3, Netlify) whose content has been removed. An attacker can claim the now-unclaimed resource on the third-party platform and host malicious content that browsers serve under the original company's subdomain.

Remediation

  • Regularly audit DNS records and remove CNAMEs for deprovisioned services
  • Before deprovisioning cloud resources, remove DNS records first
  • Monitor subdomain availability with tools like can-i-take-over-xyz

zakirkun/ice-tea/tree/main/skills/web/subdomain-takeover commit 3443471d17

Frequently asked questions

npx skillmds@latest add zakirkun/subdomain-takeover-risk