subdomain-takeover-check

What problem does it solve?

Security scanners and red team agents frequently flag potential subdomain takeovers, but most candidates are false positives that waste investigation time. This Skill provides ground-truth validation by cross-referencing flagged candidates against the canonical can-i-take-over-xyz registry, so you can focus on real risks instead of noise.

Core Features & Use Cases

• DNS Resolution Check: Identifies the target service behind a subdomain via CNAME or A/AAAA records to determine what service is being targeted for takeover.
• Registry Cross-Reference: Pulls the latest can-i-take-over-xyz service registry to check if the identified service is marked as Vulnerable, Not Vulnerable, or an Edge Case.
• Fingerprint Validation: Fetches the subdomain's live content and checks for documented service-specific fingerprints to confirm active takeover indicators.
• Use Case: When a web application scanner flags a dangling CNAME for an old AWS S3 bucket associated with your company's domain, use this Skill to quickly confirm if the bucket is actually takeable or if the alert is a false positive.

Quick Start

Use the subdomain-takeover-check skill to validate the dangling CNAME flagged for the subdomain 'old-marketing-assets.example.com'.