skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

21|1|Updated Apr 12, 2026
Search Tags:#vulnerability#dns#fingerprinting#security-recon#subdomain#takeover#cname
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill subdomain-takeover-woohyun212
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-takeover
Source: https://github.com/woohyun212/security-skill/tree/main/subdomain-takeover
Command: npx skills add https://github.com/woohyun212/security-skill --skill subdomain-takeover-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and verifies subdomain takeover vulnerabilities by identifying dangling CNAME records that point to unclaimed resources and confirming exploitability.

Core Features & Use Cases

  • Identify dangling CNAME entries for subdomains and resolve their targets.
  • Probe HTTP(S) responses to fingerprint unclaimed services and verify potential takeover.
  • Optional scans with subjack or nuclei takeover templates to broaden coverage in bug-bounty workflows.
  • Use during DNS hygiene, bug bounty recon, and decommissioning to ensure cleanup of deprecated resources.

Quick Start

Run a takeover assessment by supplying the target root domain and a subdomain list, then review the generated vulnerable findings and take remediation action.

Frequently Asked Questions about subdomain-takeover

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect subdomain takeover vulnerabilities from dangling CNAME records?▼

Detect subdomain takeover by resolving subdomain CNAME targets, probing HTTP(S) responses, and matching service fingerprints to identify unclaimed external resources. This process evaluates each DNS entry to confirm exploitability and ensure deprecated endpoints are safely decommissioned.

What is a dangling CNAME and how does it create a takeover risk?▼

A dangling CNAME is a DNS record pointing to a decommissioned or unclaimed third-party service. It creates a subdomain takeover risk because attackers can re-register that external resource and serve unauthorized content from your trusted subdomain.

Can I use subjack or nuclei templates to automate subdomain takeover scans?▼

Yes, you can optionally run subjack or nuclei takeover templates to broaden vulnerability coverage. These scans automate fingerprinting and detection, but manual verification is still required to confirm true exploitability and generate accurate findings.

How do I verify if a discovered subdomain takeover is actually exploitable?▼

Verify subdomain takeover exploitability by probing HTTP(S) responses and matching them against known service fingerprints for unclaimed resources. This confirms whether the dangling CNAME target can actually be registered and controlled by an external attacker.

When should I run a subdomain takeover assessment during DNS hygiene or decommissioning?▼

Run a subdomain takeover assessment during DNS hygiene and decommissioning to identify dangling CNAME entries left behind after removing external resources. This ensures deprecated subdomains are properly cleaned up and cannot be claimed by attackers.

Related Skills

Explore More Data & Analytics Skills→
xalgordxalgord
846

subdomain-enumeration

Enumerate subdomains and identify live hosts and takeover candidates.

Community
Advanced
xalgordxalgord
846

subdomain-takeover

Detect and validate subdomain takeover via dangling DNS records and unclaimed cloud resources.

Community
Advanced
EntroVyxEntroVyx
3

hunt-subdomain

Detect subdomain takeover vulnerabilities by analyzing DNS records and HTTP fingerprints.

Community
Advanced
uphiagouphiago
1.1k

subdomain-takeover-hunt

Detect subdomain takeover risks from dangling CNAME records.

Community
Advanced