domains / families / security / subdomain-takeover

subdomain-takeover

separate

Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.

When to use

• CNAME/NS/MX takeover detection
• Per-provider fingerprint matching
• Claim procedures for deprovisioned resources
• Defensive monitoring
• Automated CNAME takeover checking
• Multi-provider takeover scanning

When not to use

• SSRF allowlist bypass
• CORS misconfiguration
• Cross-site scripting
• Host header attacks
• Web cache deception

Skill page

Source