<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Subdomain Takeover Vulnerabilities

## subfinder — Subdomain Enumeration
```bash
subfinder -d target.com -o subdomains.txt -silent
```

## dig — DNS Record Checking
```bash
dig +short CNAME sub.target.com
dig +short cname-target.cloudprovider.com
```

## subjack — Takeover Scanner
```bash
subjack -w subdomains.txt -t 20 -timeout 30 -o results.txt -ssl
```

## nuclei — Takeover Templates
```bash
nuclei -l subdomains.txt -t http/takeovers/ -json
nuclei -l subdomains.txt -t http/takeovers/aws-bucket-takeover.yaml
```

## httpx — HTTP Probing
```bash
httpx -l subdomains.txt -mc 404 -title -tech-detect
```
