exploiting-subdomain-takeover-vulnerabilities

What problem does it solve?

Organizations often leave dangling CNAME records pointing to decommissioned cloud services, allowing attackers to claim those resources and serve malicious content on trusted subdomains. This Skill provides a structured workflow to identify, verify, and safely exploit these misconfigurations during authorized penetration tests, avoiding false positives from generic 404 responses.

Core Features & Use Cases

• Dangling DNS Detection: Enumerate subdomains, resolve full CNAME chains, and match responses against service-specific fingerprints (S3, GitHub Pages, Heroku, Azure, Shopify, Fastly) using subjack, nuclei, and manual curl checks.
• Verified Exploitation: Claim unclaimed cloud resources with benign canary content to prove takeover, including guidance for the CloudFront-vs-S3 NoSuchBucket/NoSuchKey false positive trap.
• Impact Assessment: Evaluate cookie scope, SPF/DMARC bypass, OAuth redirect, and CORS trust to determine real-world risk such as session hijacking and phishing.
• Use Case: During a bug bounty engagement, you find assets.target.com CNAMEs to a deleted S3 bucket; follow the workflow to claim the bucket, serve a benign PoC page, document cookie-theft impact, and clean up after reporting.

Quick Start

Enumerate subdomains of the authorized target, resolve their CNAME records, and check each against takeover fingerprints to confirm any claimable dangling resources.