subdomain-takeover-detection

name	subdomain-takeover-detection
description	Detect and analyze domain/subdomain takeover vulnerabilities. Use this skill whenever the user mentions subdomain takeover, domain takeover, dangling DNS records, CNAME vulnerabilities, orphaned cloud resources, or wants to audit DNS records for security issues. This skill helps identify when a subdomain points to a third-party service that's no longer claimed, allowing attackers to take control.

Subdomain Takeover Detection

A skill for identifying and analyzing domain/subdomain takeover vulnerabilities during security assessments.

What is Subdomain Takeover?

Subdomain takeover occurs when a subdomain points to a third-party service (like GitHub Pages, S3, Heroku, etc.) that has been deleted or is unclaimed. An attacker can claim that resource and control the subdomain, potentially:

• Phishing attacks - Display fake content on a trusted domain
• Session hijacking - Steal cookies via browser transparency
• CORS bypass - Access sensitive data from main domain
• OAuth token theft - Intercept redirect URIs
• CSP bypass - Inject malicious scripts
• Email spoofing - Manipulate MX records

Detection Workflow

Step 1: Identify Target Subdomains

Gather all subdomains of the target domain:

# Using subfinder
subfinder -d target.com -o subdomains.txt

# Using amass
amass enum -d target.com -o subdomains.txt

# Using chaos projectdiscovery
chaos -d target.com -o subdomains.txt

Step 2: Resolve DNS Records

Check DNS records for each subdomain:

# Using subjack (recommended)
subjack -w subdomains.txt -t 100 - 30 -o results.txt


dnsreaper -w subdomains.txt -o results.txt


dig CNAME subdomain.target.com