skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

subdomain-takeover-check

Validate subdomain takeover candidates against the can-i-take-over-xyz registry.

11|1|Updated May 4, 2026
Search Tags:#vulnerability assessment#web security#cloud security#red teaming#subdomain takeover#dns validation#cname check
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill subdomain-takeover-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-takeover-check
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/subdomain-takeover-check
Command: npx skills add https://github.com/dreadnode/capabilities --skill subdomain-takeover-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security scanners and red team agents frequently flag potential subdomain takeovers, but most candidates are false positives that waste investigation time. This Skill provides ground-truth validation by cross-referencing flagged candidates against the canonical can-i-take-over-xyz registry, so you can focus on real risks instead of noise.

Core Features & Use Cases

  • DNS Resolution Check: Identifies the target service behind a subdomain via CNAME or A/AAAA records to determine what service is being targeted for takeover.
  • Registry Cross-Reference: Pulls the latest can-i-take-over-xyz service registry to check if the identified service is marked as Vulnerable, Not Vulnerable, or an Edge Case.
  • Fingerprint Validation: Fetches the subdomain's live content and checks for documented service-specific fingerprints to confirm active takeover indicators.
  • Use Case: When a web application scanner flags a dangling CNAME for an old AWS S3 bucket associated with your company's domain, use this Skill to quickly confirm if the bucket is actually takeable or if the alert is a false positive.

Quick Start

Use the subdomain-takeover-check skill to validate the dangling CNAME flagged for the subdomain 'old-marketing-assets.example.com'.

Frequently Asked Questions about subdomain-takeover-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a subdomain takeover alert is a false positive?▼

To check if a subdomain takeover alert is a false positive, validate the flagged dangling CNAME against the can-i-take-over-xyz service registry to confirm if the target service is actually vulnerable.

What is a subdomain takeover vulnerability?▼

A subdomain takeover vulnerability occurs when a dangling DNS CNAME points to an unclaimed or deleted cloud resource, allowing an attacker to claim that resource and serve content on the subdomain.

How does DNS validation work for subdomain takeover risks?▼

DNS validation for subdomain takeover risks works by resolving the target subdomain's CNAME or A/AAAA records to identify the backend service, then cross-referencing that service against known vulnerability fingerprints.

Can I use this for cloud security auditing workflows?▼

Yes, you can use this for cloud security auditing workflows to validate flagged subdomain takeover candidates, apply HTTP fingerprint matching, and produce structured confidence scores for security teams.

Why do automated web security scanners produce false positive takeover alerts?▼

Automated web security scanners produce false positive takeover alerts because they often flag dangling CNAMEs without verifying if the target service is actually vulnerable according to canonical service registries.

What is the best way to validate dangling CNAMEs during red teaming operations?▼

The best way to validate dangling CNAMEs during red teaming operations is to cross-reference flagged candidates against the can-i-take-over-xyz registry and match live HTTP content fingerprints.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced
arbazkhan971arbazkhan971
26

predict

Assess code or feature specifications with multi-persona risk verdicts and voting gates.

Community
Advanced
EntroVyxEntroVyx
3

hunt-subdomain

Detect subdomain takeover vulnerabilities by analyzing DNS records and HTTP fingerprints.

Community
Advanced
Bsh13lderBsh13lder
4

web2-recon

Enumerate subdomains, verify live hosts, collect URLs, and scan for vulnerabilities.

Community
Intermediate