SuperAPI AI Directory
Partner中文AI newsFavorites
Skillssubdomain-takeover

subdomain-takeover

Security & auditing

View repository

Updated 10-16 05:10

About this skill

Subdomain Takeover Detection and Exploitation Methodology

1. Core Concepts

Subdomain takeover occurs when:

  1. sub.target.com There is a DNS record (CNAME/NS/A) pointing to an external service
  2. That external resourcehas been deleted/deactivated(deleted S3 bucket, removed Heroku app, etc.)
  3. An attacker can, on that provider,register/claima resource with the same name
  4. The attacker controls content under sub.target.com content under

Impact: cookie theft (parent domain cookies), OAuth token interception, phishing on a trusted domain, CORS bypass, CSP bypass.

2. Detection Methodology

2.1 CNAME Enumeration

1. 收集子域名（amass/subfinder/assetfinder/crt.sh/SecurityTrails）
2. 逐个解析 DNS：
   dig CNAME sub.target.com +short
3. 对每个 CNAME → 检查目标是否返回 NXDOMAIN 或供应商错误页
4. 用指纹表（第 3 节）匹配错误响应

2.2 Key Signals

Signal Meaning
CNAME → xxx.s3.amazonaws.com + HTTP 404 "NoSuchBucket" S3 bucket has been deleted, can be claimed
CNAME → xxx.herokuapp.com + "No such app" Heroku app has been deleted
CNAME → xxx.github.io + 404 "There isn't a GitHub Pages site here" GitHub Pages unclaimed
The CNAME target domain itself is NXDOMAIN Target domain expired or does not exist
CNAME → provider but HTTP 200 + default parking page Possibly claimable — needs verification

2.3 Automation Tools

Tool Purpose
subjack Automated CNAME takeover checks
nuclei -t takeovers/ Nuclei takeover detection templates
can-i-take-over-xyz（GitHub） Reference list of takeoverable services
dnsreaper Multi-provider takeover scanner
subzy Quick subdomain takeover verification

3. Provider Fingerprint Table

Provider CNAME Pattern Fingerprint (HTTP Response) Takeoverable?
AWS S3 *.s3.amazonaws.com / *.s3-website-*.amazonaws.com NoSuchBucket（404） ✅ Create a bucket with the same name
GitHub Pages *.github.io There isn't a GitHub Pages site here（404） ✅ Create repo + enable Pages
Heroku *.herokuapp.com / *.herokudns.com No such app ✅ Create an app with the same name
Azure *.azurewebsites.net / *.cloudapp.azure.com / *.trafficmanager.net Various default pages/NXDOMAIN ✅ Register matching resource
Shopify *.myshopify.com Sorry, this shop is currently unavailable ✅ Create shop + add custom domain
Fastly CNAME → Fastly edge Fastly error: unknown domain ✅ Add domain on Fastly
Pantheon *.pantheonsite.io 404 Site Not Found + Pantheon branding ✅
Tumblr *.tumblr.com There's nothing here / Whatever you were looking for doesn't exist ✅
WordPress.com CNAME → *.wordpress.com Do you want to register ✅ Claim on WP.com
Zendesk *.zendesk.com Help Center Closed / Zendesk branded error page ✅
Unbounce *.unbouncepages.com The requested URL was not found ✅
Ghost *.ghost.io 404 Not Found Ghost error ✅
Surge.sh *.surge.sh project not found ✅
Fly.io CNAME → *.fly.dev Fly.io default 404 ✅

4. Takeover Steps — Common Providers

4.1 AWS S3

1. 确认：curl -s http://sub.target.com → "NoSuchBucket"
2. 从 CNAME 提取 bucket 名（如 sub.target.com.s3.amazonaws.com → bucket = "sub.target.com"）
3. aws s3 mb s3://sub.target.com --region <region>
4. 上传 index.html 证明控制
5. 启用静态网站托管

4.2 GitHub Pages

1. 确认：curl -s https://sub.target.com → "There isn't a GitHub Pages site here"
2. 创建 GitHub 仓库（任意名称）
3. 添加 CNAME 文件内容为 "sub.target.com"
4. 在仓库设置中启用 GitHub Pages
5. 等待 DNS 传播（GitHub 验证 CNAME 匹配）

4.3 Heroku

1. 确认：curl -s http://sub.target.com → "No such app"
2. heroku create <cname-中的-app-name>
3. heroku domains:add sub.target.com
4. 部署 PoC 页面

5. NS Takeover — High Risk

NS takeover is far moredangerousthan CNAME takeover: it controlsall DNS resolution。

How It Happens

target.com NS → ns1.expireddomain.com
                 ↓
攻击者注册 expireddomain.com
                 ↓
攻击者控制 target.com 的全部 DNS
（A 记录、MX 记录、TXT 记录 — 一切）

Detection

1. 枚举 NS 记录：dig NS target.com +short
2. 检查每个 NS 域名：whois ns1.example.com → 域名是否过期/可注册？
3. 验证：dig A ns1.example.com → NXDOMAIN/SERVFAIL？
4. 检查子委派区域：dig NS sub.target.com

Impact

  • Full domain control (arbitrary content, email interception, issuing TLS certificates via DNS-01)
  • Issue DV certificates from any CA
  • Modify SPF/DKIM/DMARC → send authenticated email as the target

6. MX Takeover — Email Interception

When an MX record points to a deactivated mail service:

target.com MX → mail.deadservice.com（服务已停止）

If an attacker can claim mail.deadservice.com or the mail tenant:

  • Receive password reset emails
  • Intercept sensitive communications
  • Reset accounts using email authentication

Common scenarios

Expired Google Workspace / Microsoft 365 tenant → MX still points to Google/Microsoft → attacker creates a new tenant and claims the domain.

7. Wildcard DNS risk

If *.target.com has a wildcard CNAME pointing to a claimable service:

  • Everyundefined subdomain is vulnerable
  • anything.target.com can be taken over
  • Attack surface greatly increases

Detection:dig A random1234567.target.com — if it resolves successfully, a wildcard exists.

8. Decision tree

发现子域名 (sub.target.com)？
├── 解析 DNS 记录
│   ├── 有 CNAME → 外部服务？
│   │   ├── HTTP 响应匹配已知指纹？（第 3 节）
│   │   │   ├── 是 → 在供应商上尝试认领（第 4 节）
│   │   │   │   ├── 认领成功 → 接管确认
│   │   │   │   └── 认领被阻止（名称保留/区域锁定）→ 记录，尝试变体
│   │   │   └── 否 → 服务活跃，无法接管
│   │   └── CNAME 目标 NXDOMAIN？
│   │       ├── 目标是可注册域名？→ 注册 → 完全控制
│   │       └── 目标是活跃供应商的子域名 → 检查供应商认领流程
│   │
│   ├── 有 NS 记录 → 外部 nameserver？
│   │   ├── NS 域名过期/可注册？→ 注册 → 全域接管
│   │   └── NS 域名活跃 → 无法接管
│   │
│   ├── 有 MX → 外部邮件服务？
│   │   ├── 邮件服务已停用/可认领？→ 认领租户 → 邮件拦截
│   │   └── 邮件服务活跃 → 无法接管
│   │
│   └── 有 A 记录 → IP 地址？
│       ├── IP 属于弹性云（AWS EIP/Azure/GCP）？
│       │   ├── IP 未分配？→ 认领 IP → 提供内容
│       │   └── IP 已分配给其他客户 → 无法接管
│       └── IP 属于专用服务器 → 无法接管
│
└── 接管后影响评估
    ├── 与父域共享 cookie？→ 会话劫持
    ├── CORS 信任 *.target.com？→ 跨域数据窃取
    ├── CSP 白名单 *.target.com？→ 通过接管子域 XSS
    ├── OAuth redirect_uri 允许 sub.target.com？→ Token 窃取
    └── 能为 sub.target.com 签发 TLS 证书？→ 完整 MITM

9. Notes

  1. CNAME ≠ takeover: CNAME → S3 returns 403 (bucket exists but is private)is nota vulnerability. Only NoSuchBucket(404) is.
  2. S3 region issue: Bucket names are globally unique, but website endpoints are regional. Try matching the region in the CNAME.
  3. GitHub Pages verification: GitHub has added domain verification — organization-verified domains cannot be claimed by others.
  4. Edge cases: Some providers (such as CloudFront) require specific distribution configurations, not just domain claiming.
  5. Second-order takeover：sub.target.com CNAME → other.target.com CNAME → dead-service.com — the full chain must be tracked.
  6. SPF subdomain takeover: If SPF includes include:sub.target.com and you take over sub.target.com, you can modify its SPF TXT record to authorize your mail server → send forged email as target.com .

In-depth reference