<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-subdomain-takeover-vulnerabilities
description: >-
  Identify dangling DNS records pointing to deprovisioned cloud services
  (S3, Azure, GitHub Pages, Heroku) that enable subdomain takeover,
  allowing attackers to serve content, steal cookies, and bypass CSP
  under the target domain.
domain: cybersecurity
subdomain: application-security
tags:
  - subdomain-takeover
  - dns
  - cloud-security
  - dangling-cname
  - owasp-a05
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1584.001", "T1583.001"]
  owasp-top10: ["A05"]
  tools: ["subfinder", "subjack", "nuclei", "dig", "httpx"]
---

# Detecting Subdomain Takeover Vulnerabilities

## Overview

Subdomain takeover occurs when DNS records (CNAME, A, AAAA) point to
external services that have been deprovisioned. An attacker can claim the
service and serve arbitrary content under the victim's domain, enabling
cookie theft, phishing, and CSP bypass.

## Prerequisites

- Tools: subfinder, subjack, nuclei, dig, httpx
- Target domain for enumeration
- Access to register accounts on cloud providers

## Workflow

### Step 1: Subdomain Enumeration

```bash
# Subfinder passive enumeration
subfinder -d target.com -o subdomains.txt -silent

# Amass passive enumeration
amass enum -passive -d target.com -o amass_subs.txt

# Merge and deduplicate
cat subdomains.txt amass_subs.txt | sort -u > all_subs.txt
```

### Step 2: Identify Dangling Records

```bash
# Check CNAME records for all subdomains
while read sub; do
  cname=$(dig +short CNAME "$sub" | head -1)
  if [ -n "$cname" ]; then
    echo "$sub -> $cname"
  fi
done < all_subs.txt | tee cname_records.txt

# HTTP probe for takeover signatures
httpx -l all_subs.txt -mc 404 -title -tech-detect -o http_results.txt
```

### Step 3: Automated Takeover Detection

```bash
# Subjack scan
subjack -w all_subs.txt -t 20 -timeout 30 -o takeover_results.txt -ssl

# Nuclei takeover templates
nuclei -l all_subs.txt -t http/takeovers/ -o nuclei_takeover.txt -json

# Check specific providers
nuclei -l all_subs.txt -t http/takeovers/aws-bucket-takeover.yaml
nuclei -l all_subs.txt -t http/takeovers/github-takeover.yaml
```

### Step 4: Manual Verification

```bash
# Check for known takeover fingerprints
curl -s https://sub.target.com | grep -iE \
  "NoSuchBucket|There isn't a GitHub Pages|herokucdn.com/error-pages|\
No such app|Domain not found"

# Verify S3 bucket takeover
aws s3 ls s3://targetbucket 2>&1 | grep "NoSuchBucket"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| CNAME to deprovisioned service | DNS monitoring | Regular DNS record auditing |
| 404 on subdomains | HTTP monitoring | Subdomains returning service error pages |
| New content on dormant subdomain | Content monitoring | Unexpected changes indicate takeover |

```yaml
title: Subdomain Takeover Vulnerabilities Detection
id: 258e0626-ed76-4603-ab51-4226c13a71e0
status: experimental
description: Detects suspicious activity related to detecting subdomain takeover vulnerabilities techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1584.001
  - attack.t1583.001
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All subdomains enumerated via multiple sources
- [ ] CNAME records checked for dangling references
- [ ] Automated tools confirm takeover candidates
- [ ] Manual verification of takeover fingerprints
- [ ] Remediation: remove dangling DNS records or reclaim services

## References

- [Can I Take Over XYZ](https://github.com/EdOverflow/can-i-take-over-xyz)
- [HackerOne Subdomain Takeover Guide](https://www.hackerone.com/application-security/guide-subdomain-takeovers)
- [OWASP DNS Subdomain Takeover](https://owasp.org/www-project-web-security-testing-guide/)
