القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-10يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | wstg-conf-10 |
| description | Test for Subdomain Takeover |
| category | configuration |
| owasp_id | WSTG-CONF-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["misconfiguration","hardening","server","wstg","conf"] |
| tech_stack | [] |
| cwe_ids | ["CWE-16"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CONF-10
Test for Subdomain Takeover
Subdomain takeover occurs when a subdomain's DNS record points to an external service that is no longer in use or has been deleted. Attackers can claim the abandoned resource and host their own content on the victim's subdomain. This can lead to credential theft, phishing, cookie stealing, and reputation damage. Common targets include cloud services (AWS, Azure, GitHub Pages), CDNs, and SaaS platforms.
| Service | Vulnerable Indicator |
|---|---|
| GitHub Pages | 404 - "There isn't a GitHub Pages site here" |
| Heroku | "No such app" |
| AWS S3 | "NoSuchBucket" |
| Azure | "404 Web Site not found" |
| Shopify | "Sorry, this shop is currently unavailable" |
| Tumblr | "There's nothing here" |
| Fastly | "Fastly error: unknown domain" |
| Pantheon | "404 error unknown site" |
| Zendesk | "Help Center Closed" |
| Unbounce | "The requested URL was not found" |
# Amass
amass enum -d target.com -o subdomains.txt
# Subfinder
subfinder -d target.com -o subdomains.txt
# Assetfinder
assetfinder target.com >> subdomains.txt
# Certificate Transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt
-u subdomains.txt -o subdomains.txt
#!/bin/bash
# Check DNS status for each subdomain
while read subdomain; do
result=$(dig +short "$subdomain")
if [ -z "$result" ]; then
echo "[NXDOMAIN] $subdomain"
else
echo "[RESOLVED] $subdomain -> $result"
fi
done < subdomains.txt
# Check CNAME records
while read subdomain; do
cname=$(dig +short CNAME "$subdomain")
if [ ! -z "$cname" ]; then
echo "$subdomain -> CNAME: $cname"
# Check if CNAME target resolves
target_ip=$(dig +short "$cname")
if [ -z "$target_ip" ]; then
echo " [!] POTENTIAL TAKEOVER: CNAME target doesn't resolve!"
fi
fi
done < subdomains.txt
#!/bin/bash
# Check HTTP response for takeover indicators
while read subdomain; do
response=$(curl -s -L -o /dev/null -w "%{http_code}" "https://$subdomain" 2>/dev/null)
if [ "$response" == "000" ]; then
# Connection failed - check CNAME
cname=$(dig +short CNAME "$subdomain")
if [ ! -z "$cname" ]; then
echo "[CHECK] $subdomain (CNAME: $cname) - No HTTP response"
fi
elif [ "$response" == "404" ]; then
# Get page content
content=$(curl -s -L "https://$subdomain" 2>/dev/null)
# Check for known vulnerable patterns
if echo "$content" | grep -qi "There isn't a GitHub Pages site here"; then
echo "[VULN] $subdomain - GitHub Pages takeover!"
elif echo "$content" | grep -qi "NoSuchBucket"; then
echo "[VULN] $subdomain - AWS S3 takeover!"
elif echo "$content" | grep -qi "No such app"; then
echo "[VULN] $subdomain - Heroku takeover!"
elif echo "$content" | grep -qi "this shop is currently unavailable"; then
echo "[VULN] $subdomain - Shopify takeover!"
else
echo "[CHECK] $subdomain - 404 response, manual check needed"
fi
fi
done < subdomains.txt
# Check for dangling NS records
ns_records=$(dig +short NS target.com)
for ns in $ns_records; do
# Check if NS resolves
ns_ip=$(dig +short "$ns")
if [ -z "$ns_ip" ]; then
echo "[CRITICAL] NS record doesn't resolve: $ns"
fi
# Check if NS domain is available for registration
whois "${ns%.}" | grep -i "No match\|not found"
done
# Subjack
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -ssl
# Nuclei subdomain takeover templates
nuclei -l subdomains.txt -t http/takeovers/
# Can-I-Take-Over-XYZ check
# Reference: https://github.com/EdOverflow/can-i-take-over-xyz
| Tool | Description | Usage |
|---|---|---|
| Amass | Comprehensive enum | amass enum -d target.com |
| Subfinder | Fast discovery | subfinder -d target.com |
| Assetfinder | Asset discovery | assetfinder target.com |
| Tool | Description | Usage |
|---|---|---|
| Subjack | Takeover scanner | subjack -w subs.txt -ssl |
| Nuclei | Template scanner | nuclei -t takeovers/ |
| SubOver | Takeover checker | SubOver -l subs.txt |
| tko-subs | Takeover detection | tko-subs -data providers.csv |
| Tool | Description | Usage |
|---|---|---|
| dig | DNS lookup | dig CNAME subdomain.target.com |
| dnsrecon | DNS enumeration | dnsrecon -d target.com |
| dnsx | DNS toolkit | dnsx -l subs.txt -cname |
#!/bin/bash
TARGET=$1
OUTPUT_DIR="takeover_scan_$(date +%Y%m%d)"
mkdir -p $OUTPUT_DIR
echo "=== SUBDOMAIN TAKEOVER SCAN ==="
echo "Target: $TARGET"
echo ""
# 1. Enumerate subdomains
echo "[+] Enumerating subdomains..."
subfinder -d $TARGET -silent > "$OUTPUT_DIR/subdomains_subfinder.txt"
amass enum -passive -d $TARGET -o "$OUTPUT_DIR/subdomains_amass.txt" 2>/dev/null
curl -s "https://crt.sh/?q=%.$TARGET&output=json" | jq -r '.[].name_value' 2>/dev/null | sort -u > "$OUTPUT_DIR/subdomains_crt.txt"
# Combine
cat "$OUTPUT_DIR"/subdomains_*.txt | sort -u > "$OUTPUT_DIR/all_subdomains.txt"
echo "Found $(wc -l < "$OUTPUT_DIR/all_subdomains.txt") unique subdomains"
# 2. Check DNS resolution
echo ""
echo "[+] Checking DNS resolution..."
while read sub; do
cname=$(dig +short CNAME "$sub" 2>/dev/null)
if [ ! -z "$cname" ]; then
echo "$sub,$cname" >> "$OUTPUT_DIR/cname_records.txt"
fi
done < "$OUTPUT_DIR/all_subdomains.txt"
# 3. Run subjack
echo ""
echo "[+] Running subjack..."
subjack -w "$OUTPUT_DIR/all_subdomains.txt" -t 100 -timeout 30 -o "$OUTPUT_DIR/subjack_results.txt" -ssl -a 2>/dev/null
# 4. Run nuclei takeover templates
echo ""
echo "[+] Running nuclei takeover checks..."
nuclei -l "$OUTPUT_DIR/all_subdomains.txt" -t http/takeovers/ -o "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null
# Results
echo ""
echo "[+] Scan complete. Results in $OUTPUT_DIR/"
echo "Potential takeovers:"
cat "$OUTPUT_DIR/subjack_results.txt" 2>/dev/null
cat "$OUTPUT_DIR/nuclei_results.txt" 2>/dev/null
# Install
go install github.com/haccer/subjack@latest
# Basic scan
subjack -w subdomains.txt -t 100 -timeout 30 -ssl
# With output
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -o results.txt
# Verbose
subjack -w subdomains.txt -t 100 -timeout 30 -ssl -v
# Run all takeover templates
nuclei -l subdomains.txt -t http/takeovers/
# Specific service
nuclei -l subdomains.txt -t http/takeovers/github-takeover.yaml
nuclei -l subdomains.txt -t http/takeovers/aws-bucket-takeover.yaml
# Identify and remove unused DNS records
# In DNS management console:
# - Delete CNAME records pointing to decommissioned services
# - Delete A records pointing to released IPs
# - Update NS records if domains expired
# Set up regular scanning
# Add to cron:
0 0 * * * /path/to/takeover_scan.sh target.com
# Use OWASP Domain Protect or similar
Subdomain Takeover
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Remote exploitation |
| Attack Complexity | Low | Easy to exploit |
| Privileges Required | None | No auth needed |
| User Interaction | None | Passive attack |
| Scope | Changed | Affects other components |
| Confidentiality | High | Credential theft possible |
| CWE ID | Title | Description |
|---|---|---|
| CWE-284 | Improper Access Control | DNS record management |
| CWE-668 | Exposure of Resource to Wrong Sphere | Subdomain exposure |
[ ] Subdomain enumeration completed
[ ] DNS records analyzed (A, CNAME, NS)
[ ] CNAME targets verified
[ ] Dangling records identified
[ ] HTTP responses checked for takeover indicators
[ ] Automated tools run (subjack, nuclei)
[ ] NS records verified
[ ] Expired domains checked
[ ] Vulnerable subdomains documented
[ ] Risk assessment completed
[ ] Remediation plan provided