Listen to this Post
Subdomain takeovers are among the easiest yet most overlooked vulnerabilities in cybersecurity. Security researchers and bug bounty hunters often find them during reconnaissance, making them valuable low-hanging fruits.
You Should Know:
1. What is a Subdomain Takeover?
A subdomain takeover occurs when an attacker gains control over a subdomain that points to a service (e.g., Azure, AWS, GitHub Pages) that is no longer in use. If the DNS record remains active but the service is deprovisioned, an attacker can claim it.
2. Common Services Vulnerable to Takeover
- Azure (CNAME misconfigurations)
- AWS S3 Buckets
- GitHub Pages
- Heroku
- Shopify
- Fastly
3. Tools for Detecting Subdomain Takeovers
Use these tools to identify vulnerable subdomains:
Subdomain Enumeration subfinder -d example.com -o subdomains.txt assetfinder example.com | tee subdomains.txt Check Takeover Vulnerabilities subjack -w subdomains.txt -t 100 -timeout 30 -o results.json nuclei -t takeovers/ -l subdomains.txt
4. Manual Verification Steps
1. Find CNAME Records:
dig CNAME subdomain.example.com
2. Check if the Service is Active:
- If the service returns a 404 or “NoSuchBucket” (AWS S3), it may be vulnerable.
3. Claim the Subdomain:
- If using GitHub Pages, create a repo matching the subdomain.
- For AWS S3, create a bucket with the same name.
5. Automating with Nuclei Templates
nuclei -u https://example.com -t ~/nuclei-templates/takeovers/
6. Reporting the Vulnerability
- Provide proof of concept (PoC) showing control over the subdomain.
- Include steps to reproduce.
- Suggest remediation (e.g., removing stale DNS records).
What Undercode Say:
Subdomain takeovers remain a critical issue due to misconfigured DNS and forgotten cloud services. Automated tools like Subjack and Nuclei help, but manual verification ensures accuracy. Always:
– Monitor subdomains regularly.
– Remove unused DNS entries.
– Use services like Cloudflare or AWS Route 53 to detect dangling records.
Expected Output:
A detailed bug report confirming subdomain takeover, including:
- Vulnerable subdomain.
- Service provider (Azure, AWS, etc.).
- Steps to claim the subdomain.
- Remediation steps.
For further reading:
References:
Reported By: Shree Chandragiri – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
