| name | subdomain-takeover |
| description | Full subdomain-takeover matrix -- provider fingerprinting (GitHub Pages, S3, Heroku, Azure, Netlify, Shopify, and more), claimable-string signatures, the four takeover mechanisms (CNAME->NXDOMAIN, expired apex, recycled cloud IP, abandoned NS delegation), and impact multipliers. Converted from master-pentest-prompt.md Phase 17. Use on every subdomain found during recon, every engagement. |
Subdomain takeover -- full matrix
When to use
Every engagement, on every enumerated subdomain -- this is cheap to check
and frequently rewarded, so it should never be skipped even when it
doesn't feel like the main focus.
Procedure
- Enumerate all subdomains (
subfinder-mcp, crt.sh), then
dig +short CNAME each one.
- Flag CNAMEs pointing at a takeover-prone provider: GitHub Pages, S3,
Heroku, Azure, Netlify, Shopify, Zendesk, Fastly, Vercel, ReadMe,
Pantheon, GitLab Pages, Ghost, Tumblr, Surge, Azure Traffic Manager.
- Fingerprint claimable-string signatures in the response: "There isn't
a GitHub Pages site here", "NoSuchBucket", "No such app", "404 Web
Site not found", "This shop is currently unavailable" -- and check
against a
can-i-take-over-xyz-style fingerprint database for
anything not covered above.
The four takeover mechanisms
- CNAME -> NXDOMAIN (the cleanest signal -- the CNAME target doesn't
resolve at all).
- CNAME -> expired apex domain.
- A record -> recycled cloud IP (the IP was reassigned to another
cloud customer).
- NS delegation -> abandoned zone (full DNS control if claimable --
this is the highest-impact variant).
- MX -> dead host.
Impact multipliers
A takeover is worth more when the subdomain also carries: cookies scoped
to Domain=<parent> (session-cookie theft from the parent domain), a CSP
script-src allowlist entry (bypasses CSP on the main app), an OAuth
redirect_uri allowlist entry (token theft via the OAuth flow -- see the
open-redirect skill), a SAML entityID, or an SPF/DKIM include:
reference (email spoofing capability, see the email-security skill).
Note any of these explicitly in the writeup -- they're what turns a
takeover from informational into critical.
