domains / families / security / exploiting-broken-link-hijacking

exploiting-broken-link-hijacking

separate

Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced external scripts/domains, and checking DNS/CNAME records and domain registration status for expired or unclaimed resources an attacker could register. Use for subdomain takeover testing, supply-chain review of third-party scripts, or bug bounty hunting for hijackable external resources.

When to use

• When auditing web applications for references to expired or unclaimed external resources
• During supply chain security assessments of third-party script and resource dependencies
• When testing for subdomain takeover opportunities via dangling CNAME records
• During bug bounty hunting for broken link hijacking vulnerabilities
• When assessing the security of external resource dependencies in production applications

When not to use

• unauthorized use against systems you do not own or have written permission to test

Skill page

Source