hunt-subdomain

Subdomain takeover vulnerabilities are detected by analyzing DNS records and HTTP response fingerprints against known provider patterns to identify dangling CNAMEs pointing to deprovisioned services. This process validates whether abandoned third-party namespaces can be claimed.

A dangling CNAME is a DNS record pointing to a deprovisioned third-party service like GitHub Pages or S3. It enables subdomain takeover when attackers claim the abandoned service namespace to serve malicious content or perform authentication attacks.

Auditing an external attack surface for abandoned subdomains requires enumerating all DNS records and flagging any CNAMEs pointing to unclaimed third-party infrastructure. This identifies potential OAuth hijacking, session fixation, and CSP bypass risks.

Assessing the security impact of a dangling DNS record involves evaluating potential for OAuth hijacking, cookie-domain session fixation, and CSP bypasses. This determines how attackers could bypass browser security trust to facilitate phishing or credential theft.

Subdomain takeover detection operates across diverse cloud and SaaS environments by matching HTTP response fingerprints against provider-specific fingerprint databases. This confirms claimability across various deprovisioned services.

DNS enumeration tools are required to identify and validate subdomain takeover vulnerabilities. Integration with these tools and provider-specific fingerprint databases is necessary to confirm claimability across cloud and SaaS environments.