skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

subdomain-takeover-hunt

Detect subdomain takeover risks from dangling CNAME records.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#reconnaissance#dns#cloud security#vulnerability scanning#subdomain takeover#cname
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill subdomain-takeover-hunt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-takeover-hunt
Source: https://github.com/uphiago/recon-skills/tree/main/recon/subdomain-takeover-hunt
Command: npx skills add https://github.com/uphiago/recon-skills --skill subdomain-takeover-hunt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the risk of attackers exploiting dangling CNAME records that point to unclaimed third-party cloud services to take over a target's subdomains, which can enable phishing, cookie theft, and full origin impersonation of the target's web properties.

Core Features & Use Cases

  • CNAME Record Filtering: Extracts and filters CNAME records for common user-registrable cloud services including Heroku, S3, Azure, GitHub Pages, and Shopify from subdomain enumeration results.
  • Automated Vulnerability Scanning: Integrates with standard security tools like subzy, subjack, and nuclei to rapidly scan large subdomain lists for takeover indicators.
  • Manual Verification & Fingerprinting: Provides service-specific error page checks and a reference table of 16 common cloud services to confirm claimable resources and reduce false positives.
  • Use Case: During an authorized penetration test, after generating a list of alive subdomains for a target, use this Skill to quickly identify any subdomains at risk of takeover by unclaimed cloud resources.

Quick Start

Use the subdomain-takeover-hunt skill to scan your list of alive subdomains and identify any that are vulnerable to takeover via unclaimed cloud service CNAMEs.

Frequently Asked Questions about subdomain-takeover-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is a subdomain takeover vulnerability and how do dangling CNAME records cause it?▼

Subdomain takeover occurs when dangling CNAME records point to unclaimed third-party cloud services, allowing attackers to claim those resources and impersonate the target's web properties. This enables phishing, cookie theft, and full origin impersonation.

How do I scan subdomains for takeover vulnerabilities across cloud services like S3 and GitHub Pages?▼

Scanning subdomains for takeover involves extracting CNAME records pointing to registrable cloud platforms, then running automated vulnerability scanning tools like subzy, subjack, and nuclei against the list to detect unclaimed service resources.

Which cloud platforms are commonly vulnerable to subdomain takeover via dangling CNAME records?▼

Common user-registrable cloud platforms vulnerable to takeover include Heroku, S3, Azure, GitHub Pages, and Shopify. A reference table of 16 common services is used to confirm claimable resources and reduce false positives during manual verification.

Can I use this subdomain takeover scanner with my existing penetration testing reconnaissance workflow?▼

Yes, this integrates into penetration testing and reconnaissance workflows where subdomain enumeration results are screened for takeover risk. After generating alive subdomains for a target during an authorized test, use it to identify vulnerable subdomains.

How do I verify subdomain takeover findings and reduce false positives from automated scans?▼

Manual verification uses service-specific error page checks and a reference table of 16 common cloud services to confirm claimable resources, reducing false positives that automated scanning tools like subzy, subjack, and nuclei may produce during reconnaissance.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
846

subdomain-enumeration

Enumerate subdomains and identify live hosts and takeover candidates.

Community
Advanced
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-subdomain

Scan DNS records and verify claimability of unclaimed subdomains.

Community
Advanced
Bsh13lderBsh13lder
4

web2-recon

Enumerate subdomains, verify live hosts, collect URLs, and scan for vulnerabilities.

Community
Intermediate