subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

21|1|Updated Apr 12, 2026

Search Tags:#vulnerability #dns #fingerprinting #security-recon #subdomain #takeover #cname

Ready to run

npx skills add https://github.com/woohyun212/security-skill --skill subdomain-takeover-woohyun212

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: subdomain-takeover
Source: https://github.com/woohyun212/security-skill/tree/main/subdomain-takeover
Command: npx skills add https://github.com/woohyun212/security-skill --skill subdomain-takeover-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and verifies subdomain takeover vulnerabilities by identifying dangling CNAME records that point to unclaimed resources and confirming exploitability.

Core Features & Use Cases

Identify dangling CNAME entries for subdomains and resolve their targets.
Probe HTTP(S) responses to fingerprint unclaimed services and verify potential takeover.
Optional scans with subjack or nuclei takeover templates to broaden coverage in bug-bounty workflows.
Use during DNS hygiene, bug bounty recon, and decommissioning to ensure cleanup of deprecated resources.

Quick Start

Run a takeover assessment by supplying the target root domain and a subdomain list, then review the generated vulnerable findings and take remediation action.

Frequently Asked Questions about subdomain-takeover

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect subdomain takeover vulnerabilities from dangling CNAME records?▼

Detect subdomain takeover by resolving subdomain CNAME targets, probing HTTP(S) responses, and matching service fingerprints to identify unclaimed external resources. This process evaluates each DNS entry to confirm exploitability and ensure deprecated endpoints are safely decommissioned.

What is a dangling CNAME and how does it create a takeover risk?▼

A dangling CNAME is a DNS record pointing to a decommissioned or unclaimed third-party service. It creates a subdomain takeover risk because attackers can re-register that external resource and serve unauthorized content from your trusted subdomain.

Can I use subjack or nuclei templates to automate subdomain takeover scans?▼

Yes, you can optionally run subjack or nuclei takeover templates to broaden vulnerability coverage. These scans automate fingerprinting and detection, but manual verification is still required to confirm true exploitability and generate accurate findings.

How do I verify if a discovered subdomain takeover is actually exploitable?▼

Verify subdomain takeover exploitability by probing HTTP(S) responses and matching them against known service fingerprints for unclaimed resources. This confirms whether the dangling CNAME target can actually be registered and controlled by an external attacker.

When should I run a subdomain takeover assessment during DNS hygiene or decommissioning?▼

Run a subdomain takeover assessment during DNS hygiene and decommissioning to identify dangling CNAME entries left behind after removing external resources. This ensures deprecated subdomains are properly cleaned up and cannot be claimed by attackers.