subdomain-takeover

Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and impact multipliers. Converted from master-pentest-prompt.md Phase 17. Use on every subdomain found during recon, every engagement.

Jump to install

Repository: ankitsingh015/HuntMCP
Last source activity: August 24, 2026 at 11:48
Detected SKILL.md language: English
Stars: 4
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/ankitsingh015/HuntMCP --skill subdomain-takeover

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

Subdomain takeover -- full matrix

When to use

Every engagement, on every enumerated subdomain -- this is cheap to check and frequently rewarded, so it should never be skipped even when it doesn't feel like the main focus.

Procedure

Enumerate all subdomains (subfinder-mcp, crt.sh), then dig +short CNAME each one.

Flag CNAMEs pointing at a takeover-prone provider: GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, Zendesk, Fastly, Vercel, ReadMe, Pantheon, GitLab Pages, Ghost, Tumblr, Surge, Azure Traffic Manager.

Fingerprint claimable-string signatures in the response: "There isn't a GitHub Pages site here", "NoSuchBucket", "No such app", "404 Web Site not found", "This shop is currently unavailable" -- and check against a can-i-take-over-xyz-style fingerprint database for anything not covered above.

The four takeover mechanisms

CNAME -> NXDOMAIN (the cleanest signal -- the CNAME target doesn't resolve at all).

CNAME -> expired apex domain.

A record -> recycled cloud IP (the IP was reassigned to another cloud customer).

NS delegation -> abandoned zone (full DNS control if claimable -- this is the highest-impact variant).

MX -> dead host.

Impact multipliers

A takeover is worth more when the subdomain also carries: cookies scoped to Domain=<parent> (session-cookie theft from the parent domain), a CSP script-src allowlist entry (bypasses CSP on the main app), an OAuth redirect_uri allowlist entry (token theft via the OAuth flow -- see the open-redirect skill), a SAML entityID, or an SPF/DKIM include: reference (email spoofing capability, see the email-security skill). Note any of these explicitly in the writeup -- they're what turns a takeover from informational into critical.