skills.rest
lycheer1126
lycheer1126COMMUNITY
Explore all skills by this author →
GitHub

subdomain-takeover

Detects dangling DNS records and verifies claimable third-party resources for subdomain takeover.

2|1|Updated Aug 28, 2026
Search Tags:#security testing#reconnaissance#dns#bug bounty#subdomain takeover#cname#dangling dns
One-click install
npx skills add https://github.com/lycheer1126/xs-bigdan --skill subdomain-takeover-lycheer1126
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-takeover
Source: https://github.com/lycheer1126/xs-bigdan/tree/main/knowledge/skills/subdomain_takeover
Command: npx skills add https://github.com/lycheer1126/xs-bigdan --skill subdomain-takeover-lycheer1126

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Subdomains with dangling CNAME, NS, or MX records pointing to deprovisioned third-party services can be claimed by attackers, enabling content control under a trusted domain. This Skill provides a systematic hunting methodology to identify, verify, and safely confirm these vulnerabilities during authorized security testing. ## Core Features & Use Cases - Four-Element Verification Model: Confirms takeover only when a DNS record points to an external service, the resource is unclaimed, the service allows same-name registration, and control is demonstrable. - Provider Fingerprint Table: Maps CNAME patterns to HTTP response fingerprints for 14+ services (AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, and more) with claimability verdicts, plus guidance for Chinese cloud CDN scenarios. - NS/MX Takeover Coverage: Extends beyond CNAME to nameserver and mail record takeovers, which enable full subdomain DNS control and email interception for account takeover chains. - Use Case: After enumerating subdomains via crt.sh or subfinder during a bug bounty engagement, resolve each CNAME, match NXDOMAIN or vendor default-page responses against the fingerprint table, and confirm claimability before reporting. ## Quick Start Enumerate the target's subdomains, resolve each CNAME record, and check any NXDOMAIN or vendor default-page responses against the provider fingerprint table in this Skill to verify claimability.

Frequently Asked Questions about subdomain-takeover

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check for subdomain takeover vulnerabilities?▼

Enumerate subdomains via crt.sh or subfinder, resolve each CNAME with dig or dnspython, and flag targets returning NXDOMAIN or vendor default pages. Match responses against a provider fingerprint table, then verify the resource is actually claimable on that service.

What tools can automate subdomain takeover detection?▼

subjack, nuclei with takeover templates, dnsreaper, and subzy automate fingerprint matching against known vulnerable services. The can-i-take-over-xyz repository on GitHub maintains the authoritative list of claimable services.

Which cloud services are vulnerable to subdomain takeover?▼

AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon, Tumblr, WordPress.com, Zendesk, Unbounce, Ghost, Surge.sh, and Fly.io all allow claiming unregistered resources. Each has a distinct CNAME pattern and error-page fingerprint for identification.

Why does subdomain takeover detection produce false positives?▼

Wildcard DNS records make every subdomain resolve to the same IP, creating fake dangling CNAMEs. Vendor default pages also do not always mean claimable, since some providers reserve resources, so actual same-name registration must be verified.

What is NS or MX record takeover versus CNAME takeover?▼

NS takeover occurs when a subdomain's nameserver points to an expired domain, granting full DNS control over that subdomain. MX takeover targets expired mail server domains, letting an attacker receive all email for password resets and invitation links.

Is it legal to claim a subdomain to prove takeover?▼

Claiming a resource is acceptable only on explicitly authorized targets such as bug bounty scope. Verification should place a benign security-testing marker page, never phishing content or intercepted OAuth traffic, and the resource must be released afterward.

Related Skills

Explore More Software Engineering Skills→
UseOSINTUseOSINT
38

find-hidden-subdomains

Enumerate subdomains and sibling domains from Certificate Transparency logs and passive DNS.

Official
Advanced
chatbotkitchatbotkit
13

hunt-subdomain

Identify vulnerable subdomain takeovers and generate verification-ready reports with proof of ownership.

Official
Advanced
GhostPWNGhostPWN
4

Reconnaissance & OSINT Automation

Map external attack surfaces by discovering subdomains, DNS records, and web technology fingerprints.

Official
Advanced
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced