subdomain-takeover

To detect subdomain takeover vulnerabilities, you perform DNS enumeration to identify dangling CNAME, NS, or MX records pointing to deprovisioned services. This Skill analyzes those DNS records and matches error responses against known service provider fingerprints to confirm exposure.

The takeover procedure for dangling CNAME records involves matching the target's error page to a service provider fingerprint, then claiming the deprovisioned resource on platforms like AWS S3 or GitHub Pages. This Skill provides step-by-step instructions for registering the available service to complete the takeover.

An NS or MX record takeover works by registering a deprovisioned DNS provider service to hijack full zone control or email routing. This Skill guides you through identifying vulnerable NS and MX records and executing procedures for full zone and email interception.

Yes, you need prior knowledge of DNS records and service provider behaviors to effectively check for subdomain takeovers. This Skill requires understanding of DNS enumeration and error response analysis to correctly identify and exploit vulnerable CNAME, NS, and MX configurations.

To identify wildcard DNS risks and default service pages during DNS enumeration, you analyze the DNS responses for catch-all configurations. This Skill includes specialized detection logic for wildcard DNS risks and default service pages to prevent false positives during takeover validation.