Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.

SKILL: Subdomain Takeover — Detection & Exploitation Playbook AI LOAD INSTRUCTION : Covers CNAME/NS/MX takeover, per provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the resource behind the CNAME is unclaimed and claimable . 0. RELATED ROUTING [ssrf server side request forgery](../ssrf server side request forgery/SKILL.md) when a subdomain takeover is used to bypass SSRF allowlists trusting .target.com [cors cross origin misconfiguration](../cors cross origin misconfiguration/SKILL.md) when CORS trusts .target.com — takeover → full cross origin read [xss cross site scripting](../xss cross site scripting/SKILL.md) takeover gives you script execution under target origin (cookie theft, OAuth redirect abuse) [http host header attacks](../http host header attacks/SKILL.md) when Host routing leads to subdomain scoped cache or auth issues [web cache deception](../web cache deception/SKILL.md) when a taken over subdomain shares cache with the main domain 1. CORE CONCEPT Subdomain takeover occurs when: 1. sub.target.com has a DNS record (CNAME, NS, A) pointing to an external service 2. The external resource is no longer provisioned (deleted S3 bucket, removed Heroku app, etc.) 3. The attacker can register/claim that exact resource name on the provider 4. The attacker now controls content served under sub.target.com Impact : cookie theft (parent domain cookies), OAuth token interception, phishing under trusted domain, CORS bypass, CSP bypass via whitelisted subdomain. 2. DETECTION METHODOLOGY 2.1 CNAME Enumeration 2.2 Key Signals Signal Meaning CNAME → xxx.s3.amazonaws.com + HTTP 404 "NoSuchBucket" S3 bucket deleted, claimable CNAME → xxx.herokuapp.com + "No such app" Heroku app deleted CNAME → xxx.github.io + 404 "There isn't a GitHub Pages site here" GitHub Pages unclaimed NXDOMAIN on the CNAME target domain itself Target domain expired or never existed CNAME → provider but HTTP 200 with default parking page May or may not be claimable — verify 2.3 Automated Tools Tool Purpose subjack Automated CNAME takeover checking nuclei t takeovers/ Nuclei takeover detection templates can i take over xyz (GitHub) Reference for which services are vulnerable dnsreaper Multi provider takeover scanner subzy Fast subdomain takeover verification 3. SERVICE PROVIDER FINGERPRINT TABLE Provider CNAME Pattern Fingerprint (HTTP Response) Claimable? AWS S3 .s3.amazonaws.com / .s3 website .amazonaws.com NoSuchBucket (404) Yes — create bucket with matching name GitHub Pages .github.io There isn't a GitHub Pages site here (404) Yes — create repo + enable Pages Heroku .herokuapp.com / .herokudns.com No such app Yes — create app with matching name Azure .azurewebsites.net / .cloudapp.azure.com / .trafficmanager.net Various default pages, NXDOMAIN Yes — register matching resource Shopify .myshopify.com Sorry, this shop is currently unavailable Yes — create shop, add custom domain Fastly CNAME to Fastly edge Fastly error: unknown domain Yes — add domain to Fastly service Pantheon .pantheonsite.io 404 Site Not Found with Pantheon branding Yes Tumblr .tumblr.com (custom domain CNAME) There's nothing here / Whatever you were looking for doesn't exist Yes WordPress.com CNAME to .wordpress.com Do you want to register Yes — claim domain in WP.com Zendesk .zendesk.com Help Center Closed / Zendesk branding on error Yes — create matching subdomain Unbounce .unbouncepages.com The requested URL was not found Yes Ghost .ghost.io 404 Not Found Ghost error Yes Surge.sh .surge.sh project not found Yes Fly.io CNAME to .fly.dev Fly.io default 404 Yes 4. TAKEOVER PROCEDURE — COMMON PROVIDERS 4.1 AWS S3 4.2 GitHub Pages 4.3 Heroku 5. NS TAKEOVER — HIGH SEVERITY NS takeover is far more dangerous than CNAME takeover: you control all DNS resolution for the zone. How It Happens Detection Impact Full domain takeover (serve any content, intercept email, issue TLS certs via DNS 01) Issue DV certificates from any CA using DNS challenge Modify SPF/DKIM/DMARC → send authenticated email as target 6. MX TAKEOVER — EMAIL INTERCEPTION When MX records point to deprovisioned mail services: If attacker can claim mail.deadservice.com or the mail tenant: Receive password reset emails Intercept sensitive communications Potentially reset accounts that use email based auth Common Scenario Expired Google Workspace / Microsoft 365 tenant → MX still points to Google/Microsoft → attacker creates new tenant and claims the domain. 7. WILDCARD DNS RISKS If .target.com has a wildcard CNAME to a claimable service: Every undefined subdomain is vulnerable anything.target.com can be taken over Massively increases attack surface Detection: dig A random1234567.target.com — if it resolves, wildcard exists. 8. DETECTION & EXPLOITATION DECISION TREE 9. DEFENSE & REMEDIATION Action Priority Remove DNS records when deprovisioning cloud resources Critical Monitor CNAME targets for NXDOMAIN responses High Use DNS monitoring tools (SecurityTrails, DNSHistory) High Claim/reserve resource names before deleting DNS records High Audit NS delegations — ensure NS domains are owned and renewed Critical Avoid wildcard CNAMEs to third party services Medium Implement Certificate Transparency monitoring Medium 10. TRICK NOTES — WHAT AI MODELS MISS 1. CNAME ≠ takeover : A CNAME to S3 that returns 403 (bucket exists, private) is NOT vulnerable. Only NoSuchBucket (404) is. 2. Region matters for S3 : Bucket names are global, but website endpoints are regional. Try matching the region from the CNAME. 3. GitHub Pages verification : GitHub added domain verification — org verified domains cannot be claimed by others. Check if target uses this. 4. Edge cases : Some providers (e.g., Cloudfront) require specific distribution configuration, not just domain claiming. 5. Second order takeover : sub.target.com CNAME → other.target.com CNAME → dead service.com — the chain must be followed fully. 6. SPF subdomain takeover : If SPF includes include:sub.target.com and you take over sub.target.com , you can modify its SPF TXT record to authorize your mail server → send spoofed email as target.com .

subdomain-takeover