skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

subdomain-takeover

Detect and exploit subdomain takeover via DNS and provider error fingerprints.

5|2|Updated May 16, 2026
Search Tags:#vulnerability assessment#dns#saaS#cname takeover#ns takeover#mx interception#recon automation
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill subdomain-takeover-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-takeover
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/subdomain-takeover
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill subdomain-takeover-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you detect and exploit subdomain takeover conditions when dangling DNS records point to deprovisioned third-party resources or unclaimed SaaS tenants.

Core Features & Use Cases

  • DNS-based detection for CNAME/NS/MX: Enumerate subdomains, resolve record types, and identify claimable takeover scenarios using provider-aware HTTP fingerprinting.
  • Provider fingerprinting & verification: Distinguish true takeover from false positives by matching deprovisioning error signatures (for example, S3 NoSuchBucket) rather than relying on record presence alone.
  • Takeover workflows and decisioning: Provide step-by-step procedures for common providers and highlight higher-impact paths like NS takeover and MX/email interception.

Quick Start

Use the subdomain-takeover skill to analyze a target like sub.target.com by checking DNS resolution and verifying provider error fingerprints that indicate claimable takeover before proceeding to the appropriate claim procedure.

Frequently Asked Questions about subdomain-takeover

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect subdomain takeover vulnerabilities in dangling DNS records?▼

Subdomain takeover detection works by enumerating DNS records and correlating CNAME, NS, and MX findings with provider-specific HTTP resolution errors. This process identifies when deprovisioned S3, GitHub Pages, Heroku, or Azure resources can be claimed by an attacker.

What is the difference between a CNAME takeover and an NS takeover?▼

CNAME takeover targets deprovisioned third-party SaaS resources, while NS takeover involves claiming authoritative nameservers for a domain. NS takeover generally has higher impact, and MX takeover can enable email interception through deprovisioned mail providers.

How do I verify if a subdomain takeover is actually claimable?▼

You verify claimability by matching provider-specific HTTP and DNS error fingerprints, such as the S3 NoSuchBucket error signature, rather than relying on DNS record presence alone. This fingerprint matching distinguishes true takeover conditions from false positives.

Can I automate recon for subdomain takeover across multiple SaaS providers?▼

Yes, recon automation applies to takeover investigation across deprovisioned S3, GitHub Pages, Heroku, Azure, and other SaaS-backed domains. The workflow requires accurate DNS enumeration combined with provider-aware fingerprinting to identify claimable scenarios.

What should I do after confirming a subdomain takeover vulnerability?▼

After confirming a takeover, you must execute a safe decision process followed by provider-appropriate remediation and impact assessment. This ensures the vulnerability is properly documented and resolved within authorized security testing or bug bounty workflows.

Related Skills

Explore More Education & Research Skills→
utsavthakurutsavthakur

subdomain-takeover

Identify and analyze subdomain takeovers via CNAME, NS, and MX records.

Community
Advanced
chenchunrunchenchunrun
1

researching-vulnerabilities

Aggregate threat intelligence, exploit status, and asset exposure for CVE risk assessment.

Community
Advanced
EntroVyxEntroVyx
3

hunt-subdomain

Detect subdomain takeover vulnerabilities by analyzing DNS records and HTTP fingerprints.

Community
Advanced
pdparchitectpdparchitect
13

hunt-subdomain

Analyze DNS records and HTTP fingerprints to detect subdomain takeover vulnerabilities.

Community
Advanced