| name | web-subdomain-takeover |
| description | Subdomain takeover via dangling DNS/CNAME — GitHub Pages, Heroku, Azure, Fastly, Shopify, Netlify, Surge, Tumblr, Beanstalk, Zendesk, etc. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"reconnaissance","when_to_use":"subdomain takeover, dangling CNAME, dangling DNS, NXDOMAIN provider, can-i-take-over-xyz, subjack, subzy, nuclei takeover, orphaned subdomain","tags":"subdomain-takeover, dangling-dns, cname, recon, bug-bounty","mitre_attack":"T1583.001"} |
Subdomain Takeover (Dangling DNS / CNAME)
A subdomain CNAMEs to a SaaS provider (GitHub Pages, Heroku, S3, etc.) but the underlying tenant has been deleted, expired, or never claimed. Whoever registers the orphaned tenant name controls a trusted *.<TARGET> origin. Severity is almost always High → Critical because the attacker inherits the parent domain's cookie scope, CORS allowlist, OAuth redirect_uri whitelist, CSP *.<TARGET> allowance, and reputation.
1. Asset surface — enumerate every subdomain
subfinder -d <TARGET> -all -silent -o subs.txt
amass enum -passive -d <TARGET> -o subs.amass.txt
assetfinder --subs-only <TARGET> >> subs.txt
findomain -t <TARGET> -q >> subs.txt
curl -s "https://crt.sh/?q=%25.<TARGET>&output=json" | jq -r '.[].name_value' | tr | -u >> subs.txt
-u subs.txt -o subs.txt
dnsx -l subs.txt -cname -resp -silent -o subs.cname.txt
