attack-subdomain-takeover

name	attack-subdomain-takeover
description	Subdomain takeover — CNAME detection, cloud service fingerprinting, dangling DNS exploitation
category	web-application
version	1.0
author	cyberstrike-official
tags	["subdomain-takeover","dns","cloud","web","attack"]
tech_stack	["aws","azure","gcp","web"]
cwe_ids	["CWE-284"]
chains_with	[]
prerequisites	[]
severity_boost	{}

Subdomain Takeover

Objective

Identify subdomains with dangling DNS records (CNAME pointing to unclaimed cloud resources) and claim them to serve attacker content.

Testing Methodology

Phase 1: Subdomain Enumeration

# Passive enumeration
subfinder -d TARGET.com -silent | tee subdomains.txt

# Certificate transparency
curl -s "https://crt.sh/?q=%25.TARGET.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt

# DNS brute force
puredns bruteforce wordlist.txt TARGET.com -r resolvers.txt >> subdomains.txt

Phase 2: Automated Takeover Check

# Check all subdomains for takeover
attack_script subdomain_takeover subdomains.txt --json-output

Checks 20 cloud services:

• GitHub Pages, Heroku, Shopify, Tumblr, WordPress
• AWS S3, AWS Elastic Beanstalk, Azure Web Apps
• Netlify, Vercel, Fastly, Fly.io
• Bitbucket, Surge, Ghost, Pantheon
• Zendesk, README.io, Cargo, Feedpress

Phase 3: Manual CNAME Verification

# Check CNAME records
dig +short CNAME subdomain.TARGET.com

# Verify the pointed service is unclaimed
curl -s https://subdomain.TARGET.com
# Look for: "There isn't a GitHub Pages site here"
# "No such app" (Heroku)
# "NoSuchBucket" (S3)

Phase 4: Cloud Storage Enumeration

# Check related cloud buckets
attack_script cloud_storage_enum TARGET --json-output

Phase 5: Claim & Verify

After confirming a dangling CNAME:

1. Create the resource on the target service (e.g., GitHub Pages repo, S3 bucket)
2. Serve a harmless proof page (e.g., cyberstrike-takeover-proof.html)
3. Verify it's accessible at subdomain.TARGET.com

What Constitutes a Finding

Finding	Severity