Testing playbook · beginner
Subdomain Takeover
Find dangling DNS records pointing to de-provisioned cloud services you can re-claim.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Gather subdomains & CNAMEs
Collect subdomains and resolve their CNAME chains - takeovers live in dangling CNAMEs.
subfinder -d target.com -all -silent | dnsx -cname -resp -silent -o cnames.txtEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Detect fingerprints
Scan for known takeover signatures (S3, GitHub Pages, Heroku, Azure, etc.) with nuclei's takeover templates.
httpx -l cnames.txt -silent | nuclei -t http/takeovers/ -o takeover.txtEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Verify manually
Confirm the service is unclaimed and the error page matches the fingerprint before claiming. Never disrupt a live service.
curl -s https://sub.target.com | grep -i 'NoSuchBucket\|There isn.t a GitHub Pages site here'Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- A CNAME to a cloud provider + a service-specific error page = candidate.
- Report responsibly - claim only enough to prove impact (a benign PoC file).
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.