domains / families / security / subdomain-takeover-hunt

subdomain-takeover-hunt

separate

Detect and verify subdomain takeover via dangling CNAME to unclaimed services.

When to use

• Subdomain enumeration produces a large list — scan for lingering DNS records.
• Target uses cloud services with shared-namespace identifiers (Heroku, S3, Azure, Zendesk, Shopify).
• A subdomain returns NXDOMAIN, 404, or "no such app" error pages.
• The CNAME target is a service with user-registrable names.

When not to use

• Resolving CNAME to CDN services like Cloudflare, CloudFront, Akamai
• Registering resources without explicit authorization
• Scanning wildcard DNS responses

Skill page

Source