---
name: Subdomain Takeover
slug: subdomain-takeover
category: Quality
description: Subdomain Takeover identifies dangling CNAME records and fingerprints the cloud services they point to. Use it to check for takeover conditions and verify cloud storage exposure.
github: "https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/attack-subdomain-takeover"
language: TypeScript
stars: 1746
forks: 269
install: "npx degit https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/attack-subdomain-takeover ~/.claude/skills/attack-subdomain-takeover"
installs_to: ~/.claude/skills/attack-subdomain-takeover
source_path: .cyberstrike/skill/attack-subdomain-takeover/SKILL.md
collection_size: 51
category_size: 1354
collection_url: "https://dirskills.com/collections/CyberStrikeus/CyberStrike"
added: 2026-08-12T04:43:14.955Z
last_synced: 2026-08-12T04:43:14.955Z
canonical_url: "https://dirskills.com/skills/subdomain-takeover"
---

# Subdomain Takeover

Subdomain Takeover identifies dangling CNAME records and fingerprints the cloud services they point to. Use it to check for takeover conditions and verify cloud storage exposure.

**Install:**

```bash
npx degit https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/attack-subdomain-takeover ~/.claude/skills/attack-subdomain-takeover
```

## README

# Subdomain Takeover

## Objective

Identify subdomains with dangling DNS records (CNAME pointing to unclaimed cloud resources) and claim them to serve attacker content.

## Testing Methodology

### Phase 1: Subdomain Enumeration

```bash
# Passive enumeration
subfinder -d TARGET.com -silent | tee subdomains.txt

# Certificate transparency
curl -s "https://crt.sh/?q=%25.TARGET.com&output=json" | jq -r '.[].name_value' | sort -u >> subdomains.txt

# DNS brute force
puredns bruteforce wordlist.txt TARGET.com -r resolvers.txt >> subdomains.txt
```

### Phase 2: Automated Takeover Check

```bash
# Check all subdomains for takeover
attack_script subdomain_takeover subdomains.txt --json-output
```

Checks 20 cloud services:
- GitHub Pages, Heroku, Shopify, Tumblr, WordPress
- AWS S3, AWS Elastic Beanstalk, Azure Web Apps
- Netlify, Vercel, Fastly, Fly.io
- Bitbucket, Surge, Ghost, Pantheon
- Zendesk, README.io, Cargo, Feedpress

### Phase 3: Manual CNAME Verification

```bash
# Check CNAME records
dig +short CNAME subdomain.TARGET.com

# Verify the pointed service is unclaimed
curl -s https://subdomain.TARGET.com
# Look for: "There isn't a GitHub Pages site here"
# "No such app" (Heroku)
# "NoSuchBucket" (S3)
```

### Phase 4: Cloud Storage Enumeration

```bash
# Check related cloud buckets
attack_script cloud_storage_enum TARGET --json-output
```

### Phase 5: Claim & Verify

After confirming a dangling CNAME:
1. Create the resource on the target service (e.g., GitHub Pages repo, S3 bucket)
2. Serve a harmless proof page (e.g., `cyberstrike-takeover-proof.html`)
3. Verify it's accessible at `subdomain.TARGET.com`

## What Constitutes a Finding

| Finding | Severity |
|---------|----------|
| Subdomain takeover — attacker controls content | High (P2) |
| S3 bucket public write access | Critical (P1) |
| S3 bucket listing enabled | High (P2) |
| Dangling CNAME (service unreachable) | Medium (P3) |
| Cloud storage public read | Medium (P3) |

## Evidence Requirements

- Subdomain with dangling CNAME record
- Target cloud service identified
- Service fingerprint (error message)
- For takeover: proof of content hosting on subdomain
- For buckets: listing output or write proof

## Tools

- `attack_script subdomain_takeover` — automated CNAME + fingerprint checker
- `attack_script cloud_storage_enum` — S3/Azure/GCP enumeration
- `subfinder`, `puredns` — subdomain enumeration

## References

- [Can I Take Over XYZ](https://github.com/EdOverflow/can-i-take-over-xyz)
- [HackerOne: Subdomain Takeover](https://www.hackerone.com/vulnerability-management/guide-subdomain-takeovers)