skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

subdomain-takeover

Detect and validate subdomain takeover via dangling DNS records and unclaimed cloud resources.

846|152|Updated Mar 13, 2026
Search Tags:#reconnaissance#cdn#dns#penetration-testing#cloud-security#vulnerability-assessment#subdomain-takeover
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill subdomain-takeover-xalgord
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-takeover
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/vulnerabilities/subdomain-takeover
Command: npx skills add https://github.com/xalgord/xalgorix --skill subdomain-takeover-xalgord

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Subdomain takeover testing finds and verifies dangling DNS records and unclaimed cloud resources that can allow attackers to serve content from trusted subdomains, enabling phishing, cookie/CORS pivot, OAuth redirect abuse, and CDN cache poisoning.

Core Features & Use Cases

  • Comprehensive Reconnaissance: Aggregate subdomain inventories, CT logs, passive DNS, and infrastructure outputs to find candidate targets.
  • Record & Provider Fingerprinting: Resolve A/AAAA/CNAME/NS/MX/TXT chains, collapse CNAME graphs, and fingerprint HTTP/TLS responses for provider-specific "unclaimed" messages.
  • Safe Claim Validation: Guidance for authorized proof-of-control attempts, evidence collection (HTTP/TLS proof, unique payloads, optional DV certs), and post-claim validation.
  • Use Case: During a security assessment, enumerate a target's subdomains, identify dangling CNAMEs to cloud providers, and validate exploitability with minimal, authorized proofs.

Quick Start

Scan the target domain sub.example.com to enumerate dangling DNS records, fingerprint provider responses, and perform an authorized claim validation to gather proof of takeover.

Frequently Asked Questions about subdomain-takeover

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect subdomain takeover risks during a security assessment?▼

To detect subdomain takeover risks, aggregate subdomain inventories, resolve DNS record types, and fingerprint HTTP/TLS responses for provider-specific unclaimed messages. This identifies dangling DNS records and unclaimed cloud resources that allow attackers to serve content from trusted subdomains.

What is a dangling DNS record and how does it enable subdomain takeover?▼

A dangling DNS record is a CNAME or NS entry pointing to a deleted or unclaimed cloud resource. Subdomain takeover occurs when an attacker claims that resource, allowing them to serve malicious content from a trusted domain for phishing, OAuth redirect abuse, or CDN cache poisoning.

How do I validate a subdomain takeover without causing unintended damage?▼

You validate a subdomain takeover by performing authorized proof-of-control attempts and collecting evidence like HTTP/TLS proof and unique payloads. This safe claim validation confirms exploitability while gathering necessary proof without altering existing infrastructure.

Can I use subdomain takeover detection for delegated NS scenarios and CDN bindings?▼

Yes, subdomain takeover detection supports security reconnaissance on delegated NS scenarios and CDN/storage bindings. It performs DNS resolution across record types and CNAME graph analysis to find vulnerable infrastructure during asset hygiene reviews.

What is the best way to enumerate vulnerable subdomains using passive DNS and CT logs?▼

The best way to enumerate vulnerable subdomains is to aggregate CT logs, passive DNS, and infrastructure outputs to find candidate targets. This comprehensive reconnaissance builds a complete subdomain inventory for identifying dangling CNAMEs to cloud providers.

Why does subdomain takeover testing require HTTP and TLS fingerprinting?▼

Subdomain takeover testing requires HTTP and TLS fingerprinting to identify provider-specific unclaimed error messages. Analyzing these responses confirms whether a dangling DNS record points to an unclaimed cloud resource that can be registered and controlled.

Related Skills

Explore More Software Engineering Skills→
Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-subdomain

Detect DNS misconfigurations enabling subdomain takeover via CNAME chain fingerprinting.

Community
Advanced
grivera82grivera82

hunt-subdomain

Enumerate DNS records and validate CNAMEs to identify subdomain takeover risks.

Community
Advanced
pdparchitectpdparchitect
13

hunt-subdomain

Analyze DNS records and HTTP fingerprints to detect subdomain takeover vulnerabilities.

Community
Advanced
htafollahtafolla
5

security-scan

Scan codebases for security vulnerabilities and generate assessment reports.

Community
Intermediate