Subdomain Takeover

A DNS record still points at a provider resource nobody owns any more. Register it and the name is yours.

Find the dangle

# resolve everything, keep what still has a CNAME
dnsx -l subs.txt -cname -resp -silent

# https://github.com/haccer/subjack
subjack -w subs.txt -t 100 -timeout 30 -ssl -c fingerprints.json -v

# https://github.com/projectdiscovery/nuclei
nuclei -l subs.txt -t http/takeovers/ -silent

# NXDOMAIN on the CNAME target is the strongest signal
dig +short shop.target.com CNAME
dig +short target-shop.s3.amazonaws.com

Fingerprints

Full list: https://github.com/EdOverflow/can-i-take-over-xyz

Don’t stop at the CNAME

• NS takeover — a delegated zone on a nameserver you can register. Whole subtree.
• MX takeover — receive mail for the domain. Password resets.
• Dangling A record — the elastic IP was released. Rent instances until you get it.
• _acme-challenge CNAME — lets you issue a valid certificate for the parent.
• Second-order — a JS/CSS/image the main site loads from a domain that expired.

# what does the main site pull in from elsewhere?
subjs -i urls.txt | unfurl -u domains | sort -u | dnsx -silent

Why it matters more than it looks

Report the consequence, not the takeover:

• Same-site cookies scoped to .target.com are now readable
• CSP script-src *.target.com now allows your script
• OAuth redirect_uri allow-lists on *.target.com leak the code
• CORS Access-Control-Allow-Origin reflecting *.target.com
• Session fixation, phishing on a real origin

Proving it

Serve a file with your handle and the report reference. No more.

https://shop.target.com/caon-poc.txt   →   "takeover PoC, report #12345"

Do not serve anything that looks like the real site, do not collect traffic, and hand the resource back once the report is triaged.

Articles

• https://github.com/EdOverflow/can-i-take-over-xyz
• https://0xpatrik.com/subdomain-takeover/