Verified:GitHub

subdomain-takeover

Identify and analyze subdomain takeovers via CNAME, NS, and MX records.

Updated Jun 11, 2026

Search Tags:#security assessment #subdomain takeover #DNS enumeration #takeover procedure #service provider fingerprinting

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill subdomain-takeover-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: subdomain-takeover
Source: https://github.com/utsavthakur/agenticskills/tree/main/subdomain-takeover
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill subdomain-takeover-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a comprehensive guide to detecting and exploiting subdomain takeovers, which are used for security assessments and identifying potential vulnerabilities in target domains.

Core Features & Use Cases

Subdomain Enumeration: Identifies subdomains with dangling CNAME/NS/MX records pointing to deprovisioned services.
Provider Fingerprinting: Matches error responses against a database of known service provider fingerprints.
Takeover Procedures: Offers step-by-step procedures for taking over common services like AWS S3, GitHub Pages, and Heroku.
NS and MX Takeover: Special sections on NS and MX record takeovers, including full zone and email interception.
Wildcards and Default Pages: Discusses wildcard DNS risks and detection of default service pages.

Quick Start

Use the subdomain-takeover skill to check for CNAME takeovers in the domain 'target.com'.

Frequently Asked Questions about subdomain-takeover

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect subdomain takeover vulnerabilities during a security assessment?▼

To detect subdomain takeover vulnerabilities, you perform DNS enumeration to identify dangling CNAME, NS, or MX records pointing to deprovisioned services. This Skill analyzes those DNS records and matches error responses against known service provider fingerprints to confirm exposure.

What is the procedure for exploiting a dangling CNAME on AWS S3 or GitHub Pages?▼

The takeover procedure for dangling CNAME records involves matching the target's error page to a service provider fingerprint, then claiming the deprovisioned resource on platforms like AWS S3 or GitHub Pages. This Skill provides step-by-step instructions for registering the available service to complete the takeover.

How does an NS or MX record takeover work for intercepting emails and zone data?▼

An NS or MX record takeover works by registering a deprovisioned DNS provider service to hijack full zone control or email routing. This Skill guides you through identifying vulnerable NS and MX records and executing procedures for full zone and email interception.

Do I need prior knowledge of DNS records to check for subdomain takeovers?▼

Yes, you need prior knowledge of DNS records and service provider behaviors to effectively check for subdomain takeovers. This Skill requires understanding of DNS enumeration and error response analysis to correctly identify and exploit vulnerable CNAME, NS, and MX configurations.

How do I identify wildcard DNS risks and default service pages during DNS enumeration?▼

To identify wildcard DNS risks and default service pages during DNS enumeration, you analyze the DNS responses for catch-all configurations. This Skill includes specialized detection logic for wildcard DNS risks and default service pages to prevent false positives during takeover validation.